CVE-2022-47500

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.

Solution: removed the the forward component since it was improper designed for UI embedding.

User please upgrade to 1.1.0 to fix this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-475017.5Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication at CVE-2022-475027.8Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this p CVE-2022-475037.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475047.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475057.8The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a CVE-2022-475067.8SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated CVE-2022-475077.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475087.5Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were queryin CVE-2022-475096.1The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary wi CVE-2022-47515.4The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-475125.5Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HC CVE-2022-475148.8An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side re