VULNERABILITY INTELLIGENCE

CVE-2022-29158

CVSS score7.5 HIGH

EPSS probability2.18%

CISA KEVNot currently listed

Published2022-09-02

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

Weakness classification

security@apache.org: CWE-1333
nvd@nist.gov: CWE-1333

Primary references

security@apache.org — Mailing List, Patch, Third Party Advisory
security@apache.org — Mailing List, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Vendor Advisory