CVE-2022-25371

Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.

• CWE-22
• CWE-22

• http://www.openwall.com/lists/oss-security/2022/09/02/7Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/03/1Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/08/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/bvp3sczqq863lxr1wh7wjvdtjbkcwspqMailing List, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/09/02/7Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/03/1Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/08/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/bvp3sczqq863lxr1wh7wjvdtjbkcwspqMailing List, Patch, Vendor Advisory

Published

Sep 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25365Docker Desktop before 4.5.1 on Windows allows attackers to m…7.8
• CVE-2022-25366Cryptomator through 1.6.5 allows DYLIB injection because, al…7.8
• CVE-2022-25368Spectre BHB is a variant of Spectre-v2 in which malicious co…4.7
• CVE-2022-25369An issue was discovered in Dynamicweb before 9.12.8. An atta…9.8
• CVE-2022-2537The WooCommerce PDF Invoices & Packing Slips WordPress plugi…6.1
• CVE-2022-25370Apache OFBiz uses the Birt plugin (https://eclipse.github.io…5.4
• CVE-2022-25372Pritunl Client through 1.2.3019.52 on Windows allows local p…7.8
• CVE-2022-25373Zoho ManageEngine SupportCenter Plus before 11020 allows Sto…5.4
• CVE-2022-25374HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201…7.5
• CVE-2022-25375An issue was discovered in drivers/usb/gadget/function/rndis…5.5
• CVE-2022-25377The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x…7.5
• CVE-2022-2538The WP Hide & Security Enhancer WordPress plugin before 1.8 …6.1