Threat Investigation
Request a demo

CVE-2022-25370

Medium

Description

Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.

SeverityMedium
CVSS5.4
Exploit probability—
ProductApache Ofbiz
PublishedSep 2, 2022
First seenSep 2, 2022
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • apache ofbiz18.12.06 or later

Affected products

ProductAffected versionsFixed in
apache ofbizv < 18.12.0618.12.06

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.