CVE-2022-47501

HIGH EXPLOITED NUCLEI

Apache OFBiz < 18.12.07 - Unauthenticated Arbitrary File Read via Solr Plugin

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-47501 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

Nuclei Templates (1)

Apache OFBiz < 18.12.07 - Local File Inclusion
HIGHby your3cho
Shodan: html:"OFBiz" || http.html:"ofbiz" || ofbiz.visitor=
FOFA: app="Apache_OFBiz" || body="ofbiz" || app="apache_ofbiz"

References (7)

Core 7
Core References
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/18/5
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/18/9
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/19/1
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/04/19/6
Vendor Advisory release-notes
https://ofbiz.apache.org/download.html
Vendor Advisory related
https://ofbiz.apache.org/security.html

Scores

CVSS v3 7.5
EPSS 0.1018
EPSS Percentile 95.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2025-06-07
CWE
CWE-22
Status published
Products (1)
apache/ofbiz < 18.12.07
Published Apr 14, 2023
Tracked Since Feb 18, 2026