PT-2022-19398 · Apache · Apache Ofbiz

Mal + 1 · Published 2022-09-02 · Updated 2022-09-08 · CVE-2022-29063

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.06

Description The Solr plugin of Apache OFBiz is configured to automatically make a RMI request on localhost, port 1099 by default. In affected versions, an attacker may exploit this behavior by hosting a malicious RMI server on localhost to run arbitrary code at server start-up or on a server restart.

Recommendations For versions prior to 18.12.06, upgrade to at least version 18.12.06 to resolve the issue. Alternatively, apply the patches available at the specified location.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-29063

Affected Products

Apache Ofbiz

References · 4

• http://openwall.com/lists/oss-security/2022/09/02/6 · Patch
• https://osv.dev/vulnerability/CVE-2022-29063 · Vendor Advisory
• https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29063 · Security Note