CVE-2022-47500

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.

Solution: removed the the forward component since it was improper designed for UI embedding.

 User please upgrade to 1.1.0 to fix this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
Apache Software FoundationApache Helix>= 0.8.0, <= 1.0.4

References

Timeline

Published
Dec 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-475017.5Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication atCVE-2022-475027.8Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this pCVE-2022-475037.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475047.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475057.8The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a CVE-2022-475067.8SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticatedCVE-2022-475077.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-475087.5Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were queryinCVE-2022-475096.1The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary wiCVE-2022-47515.4The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back inCVE-2022-475125.5Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCCVE-2022-475148.8An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side re
CVE-2022-47500: Medium severity, CVSS 6.1 | Vulnix