Apache Helix vulnerabilities

Latest Apache Helix CVEs

Newest publication first

1. CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST

   Published 2023-07-26

   Critical·CVSS 9.8

   An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. Th...

2. CVE-2022-47500 Apache Helix: Open redirect

   Published 2022-12-19

   Medium·CVSS 6.1 EPSS 1.1%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.