Skip to content
OpenAdvisories
High WID-SEC-2024-3481 2 CVEs

Apache OFBiz: Mehrere Schwachstellen ermöglichen Codeausführung

Published Nov 17, 2024 · Updated Nov 17, 2024 · de-DE

Vendor: Apache Product: OFBiz Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um beliebigen Programmcode auszuführen.

Product

Apache OFBiz ist eine Suite von Unternehmensanwendungen und ein Framework zur Entwicklung weiterer Anwendungen.

Vulnerabilities 2

  • Critical 9.8
    CVE-2024-47208

    Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

    Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • High 8.9
    CVE-2024-48962

    Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

    Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are re…

    Apache Software Foundation Apache OFBiz

Revision history

  1. #1

    Initiale Fassung

References