CVE-2022-25371: Apache OFBiz

Critical severity, CVSS 9.8. EPSS: 5.1% chance of exploitation in the next 30 days.

Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.

Affected products

• Apache OFBiz: before 18.12.06 (fixed in 18.12.06)

Published 2022-09-02. Last modified 2026-06-17.