Not rated
CVE-2022-25371 Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and…
Description
Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OFBiz 18.12 | earliest → 18.12.05 | No fix stated |
References
- lists.apache.org lists.apache.org
- [oss-security] 20220902 Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371) www.openwall.com
- [oss-security] 20220903 Re: Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371) www.openwall.com
- [oss-security] 20220908 Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371) www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache OFBiz
The 97 CVEs of Apache OFBiz →
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
Not rated
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA component
Not rated
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
Not rated
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Not rated