Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2022-29063 Details

Description

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105 CVEMailing ListPatchVendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/02/6 CVEMailing ListPatchThird Party Advisory
https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105 [email protected]Mailing ListPatchVendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/02/6 [email protected]Mailing ListPatchThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-502Deserialization of Untrusted Data[email protected]
CWE-502Deserialization of Untrusted Data[email protected]

Affected Products

ProductVersions
apache ofbiz
< 18.12.06

CPE

  • cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2022-29063
NVD Published Date:
Sep 2, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2022-29063 Details - Not Deferred