CVE-2022-47501: fallo de gravedad alta en Apache OFBiz
Apache OFBiz: Arbitrary file reading vulnerability
Publicada el · Actualizada el
63Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 7.5epss 10%
de la publicación al arma
Publicada en NVD14 abr
VulnCheck+785d
probabilidad de explotación
10%top 4% de las CVE
explotación observada
síVulnCheck
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a
pre-authentication attack.
This issue affects Apache OFBiz: before 18.12.07.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Apache Software Foundation · Apache OFBizCVEs relacionadas — Apache OFBiz
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-45195CRITICALApache OFBiz: Confused controller-view authorization logic (forced browsing)EPSS 100.0%KEVCVE-2024-32113CRITICALApache OFBiz: Path traversal leading to RCEEPSS 99.9%KEVCVE-2024-38856HIGHApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeEPSS 99.4%KEVCVE-2021-26295—RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIEPSS 97.8%CVE-2023-51467—Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityEPSS 96.0%CVE-2023-49070—Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentEPSS 95.4%
Referencias
https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wchttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/security.htmlhttp://www.openwall.com/lists/oss-security/2023/04/18/5http://www.openwall.com/lists/oss-security/2023/04/18/9http://www.openwall.com/lists/oss-security/2023/04/19/1http://www.openwall.com/lists/oss-security/2023/04/19/6