Vulnerability · Published Dec 19, 2022 · Assigned by apache

CVE-2022-47500Apache Helix: Open redirect

Medium 6.1

In plain English

A medium-severity open redirect in Apache Helix from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)1.1%top 33.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.helix:helix	1.1.0	GHSA-mhxg-2xf7-4xwx

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Helix	0.8.0 – through 1.0.4

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh vendor-advisory