CVE-2022-25813

Katalog CVE

CVSS 7.5 · High EPSS 67,3%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine pada apache ofbiz. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.

Rincian

Terbit di NVD

2 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

67,3% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2b mailing list · patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/09/02/4 mailing list · patch · advisory pihak ketiga