Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz (Apache Software Foundation Apache OFBiz)
At a glance
- Source
- NVD
- EPSS
- EPSS 2.18 % · percentile 82 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Weaknesses (CWE)
- CWE-1333 — Inefficient Regular Expression Complexity
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-33566
- GCVE · GCVE-0-2022-29158
Affected configurations (NVD CPE)
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*< 18.12.06
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache OFBiz | affected Apache OFBiz ≤ 18.12.05 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |