PT-2022-17248 · Apache · Apache Ofbiz

Aleksey Solovev + 1 · Published 2022-09-02 · Updated 2022-09-07 · CVE-2022-25370

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.05

Description The issue allows an unauthenticated malicious user to perform a stored XSS attack, enabling the injection of a malicious payload that can be executed. This is made possible by leveraging a vulnerability in the Birt plugin used by Apache OFBiz for data visualizations and reports.

Recommendations For Apache OFBiz versions prior to 18.12.05, update to a version that includes the fix for the Birt plugin vulnerability to prevent stored XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-25370

Affected Products

Apache Ofbiz

References · 5

• https://lists.apache.org/thread/vrvzokvxqtc4t6d7g8xgz89xpxcvjofh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25370 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25370 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/09/03/1 · Note
• http://openwall.com/lists/oss-security/2022/09/02/8 · Note