CVE-2022-29158
published 2022-09-02CVE-2022-29158: Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.75%
75.4th percentile
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | < 18.12.06 | 18.12.06 |
| apache | ofbiz | — | — |
| apache_software_foundation | apache_ofbiz | Apache OFBiz – 18.12.05 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_apache7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache ofbiz: CVE-2022-29158
vendor_apache·CVSS 7.5
CVE-2022-29158 [HIGH] Apache ofbiz: CVE-2022-29158
Apache ofbiz: CVE-2022-29158
; affected releases before 18.12.06; fixed in 18.12.06 with commit ff92c4bc9
GHSA
GHSA-7hxq-2vp3-4xmj: Apache OFBiz up to version 18
ghsa_unreviewed·2022-09-03
CVE-2022-29158 [HIGH] CWE-1333 GHSA-7hxq-2vp3-4xmj: Apache OFBiz up to version 18
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-02
Published