Apache OFBiz: Arbitrary file reading vulnerability
Priority MEDIUM 51CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.1018 95th percentileScored 2026-11-07
Fix Fixed Apache OFBiz (Apache Software Foundation): 18.12.07
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Apache OFBiz (Apache Software Foundation) Fixed in 18.12.07
Timeline
- 2026-10-02 Threatist record created from CVE-2022-47501
- 2026-10-03 Alias added: GHSA-mxw6-c2fh-2h9w
References
Advisory 7
- https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc
- https://ofbiz.apache.org/download.html
- https://ofbiz.apache.org/security.html
- http://www.openwall.com/lists/oss-security/2023/04/18/5
- http://www.openwall.com/lists/oss-security/2023/04/18/9
- http://www.openwall.com/lists/oss-security/2023/04/19/1
- http://www.openwall.com/lists/oss-security/2023/04/19/6
More Apache Ofbiz vulnerabilities
- TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
- TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2024-30542 Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE CVSS 3.1CRITICAL 9.8
- TI-2021-08129 RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI CVSS 3.1CRITICAL 9.8
- TI-2023-28119 Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-47501 · CVE Program
- CVE-2022-47501 · NVD
- FIRST EPSS
- GHSA-mxw6-c2fh-2h9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences