CVE-2022-29158: fallo en Apache OFBiz
Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.2%
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Productos afectados
Apache Software Foundation · Apache OFBizCVEs relacionadas — Apache OFBiz
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-45195CRITICALApache OFBiz: Confused controller-view authorization logic (forced browsing)EPSS 100.0%KEVCVE-2024-32113CRITICALApache OFBiz: Path traversal leading to RCEEPSS 99.9%KEVCVE-2024-38856HIGHApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeEPSS 99.4%KEVCVE-2021-26295—RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIEPSS 97.8%CVE-2024-45507HIGHApache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCEEPSS 96.4%CVE-2023-51467—Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityEPSS 96.0%