{"id":"CVE-2022-25370","aliases":["EUVD-2022-30041","GHSA-qgqg-hf9q-5fjp"],"status":"published","title":"Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz","description":"Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02807,"percentile":0.8661,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-09-02T07:10:16Z","modified":"2026-06-17T04:33:28Z","products":[{"vendor":"apache","product":"ofbiz"},{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://lists.apache.org/thread/vrvzokvxqtc4t6d7g8xgz89xpxcvjofh","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/02/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/03/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25370"},{"url":"https://github.com/advisories/GHSA-qgqg-hf9q-5fjp"}],"sources":{"cve":[{"id":"CVE-2022-25370","title":"Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz","description":"Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.","status":"published","published":"2022-09-02T07:10:16Z","modified":"2024-08-03T04:36:06.924Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-30041","description":"Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.","status":"published","published":"2022-09-02T07:10:16Z","modified":"2024-08-03T04:36:06Z","updated_at":"2026-11-03T03:25:47.443246Z"}],"ghsa":[{"id":"GHSA-qgqg-hf9q-5fjp","title":"Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data...","description":"Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.","status":"published","published":"2022-09-03T00:00:25Z","modified":"2023-01-28T05:07:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:44:31.117774Z"}],"nvd":[{"id":"CVE-2022-25370","description":"Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.","status":"published","published":"2022-09-02T07:15:07.32Z","modified":"2026-06-17T04:33:28.403Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:26.802986Z"}]}}