Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.
The same uri can be operated to realize a SSRF attack also without authorizations.
Users are recommended to upgrade to version 18.12.11, which fixes this issue.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2023/12/26/2 | Mailing List Third Party Advisory |
https://issues.apache.org/jira/browse/OFBIZ-12875 | Issue Tracking Patch Vendor Advisory |
https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q | Mailing List Vendor Advisory |
https://ofbiz.apache.org/download.html | Product |
https://ofbiz.apache.org/release-notes-18.12.11.html | Release Notes |
https://ofbiz.apache.org/security.html | Vendor Advisory |
Configurations
History
04 Jan 2024, 03:01
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.openwall.com/lists/oss-security/2023/12/26/2 - Mailing List, Third Party Advisory | |
References | () https://ofbiz.apache.org/download.html - Product | |
References | () https://ofbiz.apache.org/release-notes-18.12.11.html - Release Notes | |
References | () https://ofbiz.apache.org/security.html - Vendor Advisory | |
References | () https://issues.apache.org/jira/browse/OFBIZ-12875 - Issue Tracking, Patch, Vendor Advisory | |
References | () https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q - Mailing List, Vendor Advisory | |
First Time |
Apache ofbiz
Apache |
|
CPE | cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
CWE |
26 Dec 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
26 Dec 2023, 12:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-12-26 12:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-50968
Mitre link : CVE-2023-50968
CVE.ORG link : CVE-2023-50968
JSON object : View
Products Affected
apache
- ofbiz