# CVE-2022-47501: Apache OFBiz - Arbitrary File Read

> Live exploitation tracking for CVE-2022-47501 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-47501

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Apache OFBiz
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

## Description

Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack.

## CrowdSec analysis

[CVE-2022-47501](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-47501) is a vulnerability in Apache OFBiz related to the Solr plugin, enabling attackers to read arbitrary files on the server via a pre-authentication flaw.

CrowdSec has been tracking this vulnerability and its exploits since 25th of February 2025.

CrowdSec network data shows that most actors exploiting CVE-2022-47501 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2022-47501 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Exploitation attempts are characterized by requests to URLs containing `/solr/solrdefault/debug/dump?param=contentstreams&stream.url=file://`.

## Timeline

- 2023-04-14: CVE Published. CVE-2022-47501 is published to NVD.
- 2025-02-25: Rule Released. CrowdSec releases a rule to detect CVE-2022-47501 exploitation attempts against the CrowdSec Network.
- 2025-02-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-47501 for the first time.

## References

- https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc
- https://ofbiz.apache.org/download.html
- https://ofbiz.apache.org/security.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47501.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-47501) follows observed exploitation activity for CVE-2022-47501. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.