CVE-2022-25370 — Cross-site Scripting in Apache Ofbiz

CWE-79 — Cross-site ScriptingCWE-269 — Improper Privilege ManagementCWE-416 — Use After FreeCWE-200 — Sensitive Information Exposure7 documents5 sources
Severity
5.4MEDIUMNVD
CISA4.4
EPSS
1.0%
top 23.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache OfbizApache Software Foundation Apache Ofbiz
Timeline
PublishedSep 2
Latest updateNov 8

Description

Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDapache/ofbiz< 18.12.06
▶CVEListV5apache_software_foundation/apache_ofbizApache OFBiz — 18.12.05

🔴Vulnerability Details

2
GHSA
GHSA-qgqg-hf9q-5fjp: Apache OFBiz uses the Birt plugin (https://eclipse↗2022-09-03
▶
CVEList
Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz↗2022-09-02
▶

📋Vendor Advisories

4
CISA
Samsung Mobile Devices Improper Access Control Vulnerability↗2022-11-08
▶
CISA
Samsung Mobile Devices Memory Corruption Vulnerability↗2022-11-08
▶
CISA
Samsung Mobile Devices Improper Access Control Vulnerability↗2022-11-08
▶
Apache
Apache ofbiz: CVE-2022-25370↗
▶
CVE-2022-25370 — Cross-site Scripting in Apache Ofbiz | cvebase