CVE-2022-25370

Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.

• CWE-79
• CWE-79

• http://www.openwall.com/lists/oss-security/2022/09/02/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/03/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread/vrvzokvxqtc4t6d7g8xgz89xpxcvjofhIssue Tracking, Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/09/02/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/03/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread/vrvzokvxqtc4t6d7g8xgz89xpxcvjofhIssue Tracking, Mailing List, Vendor Advisory

Published

Sep 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25364In Gradle Enterprise before 2021.4.2, the default built-in b…8.1
• CVE-2022-25365Docker Desktop before 4.5.1 on Windows allows attackers to m…7.8
• CVE-2022-25366Cryptomator through 1.6.5 allows DYLIB injection because, al…7.8
• CVE-2022-25368Spectre BHB is a variant of Spectre-v2 in which malicious co…4.7
• CVE-2022-25369An issue was discovered in Dynamicweb before 9.12.8. An atta…9.8
• CVE-2022-2537The WooCommerce PDF Invoices & Packing Slips WordPress plugi…6.1
• CVE-2022-25371Apache OFBiz uses the Birt project plugin (https://eclipse.g…9.8
• CVE-2022-25372Pritunl Client through 1.2.3019.52 on Windows allows local p…7.8
• CVE-2022-25373Zoho ManageEngine SupportCenter Plus before 11020 allows Sto…5.4
• CVE-2022-25374HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201…7.5
• CVE-2022-25375An issue was discovered in drivers/usb/gadget/function/rndis…5.5
• CVE-2022-25377The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x…7.5