CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962

CVE-2024-48962 affects Apache OFBiz versions before 18.12.17. The issue combines improper generation of code (code injection) with CSRF, arising from improper neutralization of certain template elements. This can enable unauthorized actions or code execution within vulnerable OFBiz deployments. T...

Apache OFBiz 代码问题漏洞

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security vulnerability exists in Apache OFBiz that stems from the product's failure to properly validate...

CVE-2024-47208: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue...

Apache OFBiz 安全漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation in the United States. The system provides a suite of Java-based web application components and tools. A security vulnerability exists in Apache OFBiz versions prior to 18.12.17 that stems from improper...

CVE-2024-48962: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

PT-2024-8602 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery CSRF and improper neutralization of special elements...

PT-2024-8600 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to Server-Side Request Forgery SSRF and Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This vulnerability may allow a remote...

Apache OFBiz < 18.12.16 Remote Code Execution

Apache OFBiz versions prior to 18.12.16 suffers from a vulnerability allowing a remote and unauthenticated attacker to arbitrary write file to the target instance and Remote Code Execution RCE on the vulnerable system. Note that this plugin requires the 'File Upload' assessment option enabled in...

Apache OFBiz < 18.12.16 Multiple Vulnerabilities

The version of Apache OFBiz running on the remote host is prior to 18.12.16. It is, therefore, potentially affected by the following vulnerabilities: - Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. CVE-2024-45507 - Direct...

Imperva Protects Against Critical Apache OFBiz Vulnerability (CVE-2024-45195)

Recently, a critical vulnerability in the widely used Apache OFBiz framework was disclosed, designated CVE-2024-45195. This vulnerability allows for unauthenticated remote code execution RCE, making it an especially dangerous flaw for organizations using OFBiz in their business operations. An...

The vulnerability of the Apache OFBiz resource planning software lies in security mechanism failures, which allow attackers to gain unauthorized access to protected information or cause other adverse effects.

The vulnerability of Apache OFBiz’s enterprise resource planning software relates to security mechanism errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or cause other adverse effects...

VulnCheck KEV: CVE-2024-45195

Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access...

The vulnerability of the Apache OFBiz resource planning software lies in the insufficient validation of incoming requests, allowing a hacker to execute an SSRF attack.

The vulnerability of Apache OFBiz’s resource planning software lies in the insufficient verification of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

K000141002: Apache OFBiz vulnerabilities CVE-2024-32113, CVE-2024-36104, and CVE-2024-45195

Security Advisory Description CVE-2024-32113 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. CVE-2024-36104...

Apache OFBiz Update Fixes High-Severity Flaw Leading to Remote Code Execution

A new security flaw has been addressed in the Apache OFBiz open-source enterprise resource planning ERP system that, if successfully exploited, could lead to unauthenticated remote code execution on Linux and Windows. The high-severity vulnerability, tracked as CVE-2024-45195 CVSS score: 7.5,...

CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed)

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server. Exploitation is facilitated by bypassing...