Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um seine Privilegien zu erhöhen oder Code auszuführen.
Product
Apache OFBiz ist eine Suite von Unternehmensanwendungen und ein Framework zur Entwicklung weiterer Anwendungen.
Vulnerabilities 2
-
High 8.8
Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
-
High 8.8
Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. Thi…
Revision history
-
#1
Initiale Fassung
References
-
The Apache OFBiz Project Security vom 2026-06-10
https://ofbiz.apache.org/security.html
-
Apache Advisory vom 2026-06-10
https://lists.apache.org/thread/xqph4qjm163kmp0tcg9dodl6js499n75
-
Apache Advisory vom 2026-06-10
https://lists.apache.org/thread/trr2p4zokg54glqlhjnglt4yr7n8t5xd
-
OSS Security Mailing List vom 2026-06-10
https://seclists.org/oss-sec/2026/q2/873
-
OSS Security Mailing List vom 2026-06-10
https://seclists.org/oss-sec/2026/q2/874
-
GitHub Security Advisory GHSA-7c94-45hg-hmp3 vom 2026-06-10
https://github.com/advisories/GHSA-7c94-45hg-hmp3
-
GitHub Security Advisory GHSA-862q-5rrg-cc9p vom 2026-06-10
https://github.com/advisories/GHSA-862q-5rrg-cc9p