Beveiligingsadvies

CVE-2022-25813

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2022-09-02 07:10:18

Laatst bijgewerkt 2024-08-03 04:49:43

Toegewezen door apache

CVSS-score geen score

Status PUBLISHED

Beschrijving

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.

← Alle CVE's bekijken Bekijk op cve.org ↗