Vulnerability · Published Aug 18, 2021 · Assigned by apache
CVE-2021-37608Arbitrary file upload vulnerability in OFBiz
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)6.0%top 6.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | unspecified – through 17.12.07 |
Weakness: CWE-434
References
- https://ofbiz.apache.org/security.html x_refsource_MISC
- [ofbiz-notifications] 20210827 [jira] [Updated] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210827 [jira] [Created] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210902 [jira] [Assigned] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-commits] 20210903 [ofbiz-framework] branch release18.12 updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) mailing-list, x_refsource_MLIST
- [ofbiz-commits] 20210903 [ofbiz-framework] branch release17.12 updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) mailing-list, x_refsource_MLIST
- [ofbiz-commits] 20210903 [ofbiz-framework] branch trunk updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210903 [jira] [Commented] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210903 [jira] [Closed] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210904 [jira] [Comment Edited] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210904 [jira] [Updated] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-commits] 20210917 [ofbiz-framework] branch release18.12 updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) mailing-list, x_refsource_MLIST
- [ofbiz-commits] 20210917 [ofbiz-framework] branch release17.12 updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20210917 [jira] [Commented] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-commits] 20210917 [ofbiz-framework] branch trunk updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20211014 [jira] [Comment Edited] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20211014 [jira] [Commented] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST
- [ofbiz-notifications] 20211015 [jira] [Commented] (OFBIZ-12307) CVE-2021-37608 vulnerability bypass mailing-list, x_refsource_MLIST