Apache Helix UI vulnerable to Open Redirect

MEDIO 6.1CVE-2022-47500 · GHSA-mhxg-2xf7-4xwx · Published 19/12/2022 · updated 17/06/2026

En resumen

CVE-2022-47500 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a org.apache.helix:helix, helix (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 66.3% de las vulnerabilidades.
Solución: actualizar a 1.1.0 o posterior.

Package	Affected versions	Patched versions
org.apache.helix:helix Maven	`≥ 0.8.0, < 1.1.0`	`1.1.0`
helix apache	`≥ 0.8.0, ≤ 1.0.4`	No fix yet

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to and including 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.

NVD description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.

References

nvd.nist.gov/vuln/detail/CVE-2022-47500 · ADVISORY
apache/helix · PACKAGE
lists.apache.org/thread/lr74xtxxbb1t3dfn5qzzwl2xjr3qlbmh · WEB

Más vulnerabilidades de org.apache.helix:helix

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.helix:helix

Maven

≥ 0.8.0, < 1.1.0

1.1.0

helix

apache

≥ 0.8.0, ≤ 1.0.4

No fix yet

Description

NVD description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.