CVE-2022-47500 - Vulnerability Details - OpenCVE

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.

Solution: removed the the forward component since it was improper designed for UI embedding.

User please upgrade to 1.1.0 to fix this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00808.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apache	Helix

Configuration 1 [-]

cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh

History

Thu, 17 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2022-12-19T10:03:41.428Z

Updated: 2025-04-17T14:22:18.663Z

Reserved: 2022-12-15T09:11:56.805Z

Link: CVE-2022-47500

Vulnrichment

Updated: 2024-08-03T14:55:08.395Z

NVD

Status : Modified

Published: 2022-12-19T11:15:11.203

Modified: 2025-04-17T15:15:52.387

Link: CVE-2022-47500

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-47500", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "requesterUserId": "cf81350d-439c-4450-9d42-0a054bb6b6c9", "dateReserved": "2022-12-15T09:11:56.805Z", "datePublished": "2022-12-19T10:03:41.428Z", "dateUpdated": "2025-04-17T14:22:18.663Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Helix", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.0.4", "status": "affected", "version": "0.8.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "This issue was discovered by Everardo Padilla Saca"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.<p>This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.</p><p></p><b>Solution</b>: removed the the forward component since it was improper designed for UI embedding.<br><br><span style=\"background-color: rgb(255, 255, 255);\"> User please upgrade to 1.1.0 to fix this issue.<br></span><br>"}], "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.\n\n\n\nSolution: removed the the forward component since it was improper designed for UI embedding.\n\n\u00a0User please upgrade to 1.1.0 to fix this issue.\n\n"}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-12-19T10:03:41.428Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Helix: Open redirect", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:55:08.395Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh"}]}, {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-17T14:21:47.906638Z", "id": "CVE-2022-47500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T14:22:18.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:55:08.395Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-47500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-17T14:21:47.906638Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T14:22:14.282Z"}}], "cna": {"title": "Apache Helix: Open redirect", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "This issue was discovered by Everardo Padilla Saca"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Helix", "versions": [{"status": "affected", "version": "0.8.0", "versionType": "custom", "lessThanOrEqual": "1.0.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.\n\n\n\nSolution: removed the the forward component since it was improper designed for UI embedding.\n\n\u00a0User please upgrade to 1.1.0 to fix this issue.\n\n", "supportingMedia": [{"type": "text/html", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.<p>This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.</p><p></p><b>Solution</b>: removed the the forward component since it was improper designed for UI embedding.<br><br><span style=\"background-color: rgb(255, 255, 255);\"> User please upgrade to 1.1.0 to fix this issue.<br></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-12-19T10:03:41.428Z"}}}, "cveMetadata": {"cveId": "CVE-2022-47500", "state": "PUBLISHED", "dateUpdated": "2025-04-17T14:22:18.663Z", "dateReserved": "2022-12-15T09:11:56.805Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2022-12-19T10:03:41.428Z", "requesterUserId": "cf81350d-439c-4450-9d42-0a054bb6b6c9", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:*", "matchCriteriaId": "BBB15C6B-BDD8-4917-BF45-4F07FB25826E", "versionEndIncluding": "1.0.4", "versionStartIncluding": "0.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.\n\n\n\nSolution: removed the the forward component since it was improper designed for UI embedding.\n\n\u00a0User please upgrade to 1.1.0 to fix this issue.\n\n"}, {"lang": "es", "value": "Vulnerabilidad de redireccionamiento de URL a un sitio que no es de confianza (\"Open Redirect\") en Apache Software Foundation Apache Helix UI component. Este problema afecta a todas las versiones de Apache Helix desde 0.8.0 a 1.0.4. Soluci\u00f3n:se elimin\u00f3 el componente delantero porque no estaba dise\u00f1ado correctamente para la incrustaci\u00f3n de la interfaz de usuario. Usuario, actualice a 1.1.0 para solucionar este problema."}], "id": "CVE-2022-47500", "lastModified": "2025-04-17T15:15:52.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-19T11:15:11.203", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security@apache.org", "type": "Secondary"}]}