Riskcovery

CVE-2022-29063

Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz

State
Published
Severity
Not scored
Published
Sep 2, 2022
Updated
Aug 3, 2024
Reserved
Apr 11, 2022

Read the record on cve.org

Description

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-502 Deserialization of Untrusted Data

Affected Products

ProductVersions
Apache OFBizApache Software Foundation
  • Apache OFBiz through 18.12.05Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.