CVE-2022-47501

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-47501
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/04/18/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/18/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/19/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/19/6 Mailing List Third Party Advisory
https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc Vendor Advisory
https://ofbiz.apache.org/download.html Vendor Advisory
https://ofbiz.apache.org/security.html Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/04/18/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/18/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/19/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/19/6 Mailing List Third Party Advisory
https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc Vendor Advisory
https://ofbiz.apache.org/download.html Vendor Advisory
https://ofbiz.apache.org/security.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
History

13 Feb 2025, 17:15

Type Values Removed Values Added
Summary (en) Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07. (en) Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

21 Nov 2024, 07:32

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/04/18/5 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/04/18/5 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/04/18/9 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/04/18/9 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/04/19/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/04/19/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/04/19/6 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/04/19/6 - Mailing List, Third Party Advisory
References () https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc - Vendor Advisory () https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc - Vendor Advisory
References () https://ofbiz.apache.org/download.html - Vendor Advisory () https://ofbiz.apache.org/download.html - Vendor Advisory
References () https://ofbiz.apache.org/security.html - Vendor Advisory () https://ofbiz.apache.org/security.html - Vendor Advisory

26 Apr 2023, 14:41

Type Values Removed Values Added
First Time Apache
Apache ofbiz
CPE cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) http://www.openwall.com/lists/oss-security/2023/04/19/6 - (MISC) http://www.openwall.com/lists/oss-security/2023/04/19/6 - Mailing List, Third Party Advisory
References (MISC) https://ofbiz.apache.org/security.html - (MISC) https://ofbiz.apache.org/security.html - Vendor Advisory
References (MISC) https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc - (MISC) https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc - Vendor Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/04/19/1 - (MISC) http://www.openwall.com/lists/oss-security/2023/04/19/1 - Mailing List, Third Party Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/04/18/5 - (MISC) http://www.openwall.com/lists/oss-security/2023/04/18/5 - Mailing List, Third Party Advisory
References (MISC) https://ofbiz.apache.org/download.html - (MISC) https://ofbiz.apache.org/download.html - Vendor Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/04/18/9 - (MISC) http://www.openwall.com/lists/oss-security/2023/04/18/9 - Mailing List, Third Party Advisory

19 Apr 2023, 12:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/04/19/6 -

19 Apr 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/04/19/1 -

18 Apr 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/04/18/9 -

18 Apr 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/04/18/5 -

14 Apr 2023, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-14 16:15

Updated : 2025-02-13 17:15

NVD link : CVE-2022-47501

Mitre link : CVE-2022-47501

CVE.ORG link : CVE-2022-47501

JSON object : View

Products Affected

apache

  • ofbiz
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')