Vulnerability · Published Apr 14, 2023 · Assigned by apache
CVE-2022-47501Apache OFBiz: Arbitrary file reading vulnerability
High 7.5
In plain English
A high-severity path traversal in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.2% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)10.2%top 4.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 18.12.06 – before 18.12.07 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc vendor-advisory
- https://ofbiz.apache.org/download.html release-notes
- https://ofbiz.apache.org/security.html related
- http://www.openwall.com/lists/oss-security/2023/04/18/5
- http://www.openwall.com/lists/oss-security/2023/04/18/9
- http://www.openwall.com/lists/oss-security/2023/04/19/1
- http://www.openwall.com/lists/oss-security/2023/04/19/6