CVE-2022-29063

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.

• CWE-502
• CWE-502

• http://www.openwall.com/lists/oss-security/2022/09/02/6Mailing List, Patch, Third Party Advisory
• https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105Mailing List, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/09/02/6Mailing List, Patch, Third Party Advisory
• https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105Mailing List, Patch, Vendor Advisory

Published

Sep 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29058An improper neutralization of special elements [CWE-89] used…7.8
• CVE-2022-29059An improper neutralization of special elements used in an SQ…7.2
• CVE-2022-2906An attacker can leverage this flaw to gradually erode availa…7.5
• CVE-2022-29060A use of hard-coded cryptographic key vulnerability [CWE-321…8.1
• CVE-2022-29061An improper neutralization of special elements used in an OS…7.2
• CVE-2022-29062Multiple relative path traversal vulnerabilities [CWE-23] in…6.5
• CVE-2022-2907An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2022-29071This advisory documents an internally found vulnerability in…5.5
• CVE-2022-290727-Zip through 21.07 on Windows allows privilege escalation a…7.8
• CVE-2022-29077A heap-based buffer overflow exists in rippled before 1.8.5.…9.8
• CVE-2022-29078The ejs (aka Embedded JavaScript templates) package 3.1.6 fo…9.8
• CVE-2022-2908A potential DoS vulnerability was discovered in Gitlab CE/EE…4.3