CVE-2022-25371

9.8 criticalEPSS 5.4%

Critical (9.8) in apache ofbiz. EPSS 5.4% chance of exploitation in the next 30 days.

Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.4% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2022-09-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:ofbiz

References

http://www.openwall.com/lists/oss-security/2022/09/02/7
http://www.openwall.com/lists/oss-security/2022/09/03/1
http://www.openwall.com/lists/oss-security/2022/09/08/2
https://lists.apache.org/thread/bvp3sczqq863lxr1wh7wjvdtjbkcwspq
http://www.openwall.com/lists/oss-security/2022/09/02/7

Check your stack JSON