CVE-2022-25813: vulnerability in Apache OFBiz
Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Apache OFBiz's ecommerce plugin allows an attacker to inject malicious code into a contact form's subject field. When a manager views the message, the code executes on the server, giving the attacker full control of the system.
Server-Side Template Injection (SSTI) in the party component's communication display functionality. An unauthenticated attacker can inject template syntax via the contact form subject field; exploitation requires a manager to access the communications list, triggering template evaluation and enabling remote code execution.
In the same product, most dangerous first.