CVE-2022-47501

Description

Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

Reserved 2022-12-15 | Published 2023-04-14 | Updated 2024-10-17 | Assigner apache

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
affected

18.12.06 before 18.12.07
affected

Credits

Skay <lhcaomail@gmail.com> finder

References

lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc vendor-advisory

ofbiz.apache.org/download.html release-notes

ofbiz.apache.org/security.html related

www.openwall.com/lists/oss-security/2023/04/18/5

www.openwall.com/lists/oss-security/2023/04/18/9

www.openwall.com/lists/oss-security/2023/04/19/1

www.openwall.com/lists/oss-security/2023/04/19/6

cve.org (CVE-2022-47501)

nvd.nist.gov (CVE-2022-47501)

Download JSON