Vulnerability · Published Dec 26, 2023 · Assigned by apache
CVE-2023-50968Apache OFBiz: Arbitrary file properties reading and SSRF attack
High 7.5
In plain English
A high-severity information exposure in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 63.4% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)63.4%top 0.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 – through 18.12.10 |
Weakness: CWE-200, CWE-918
References
- https://ofbiz.apache.org/download.html mitigation
- https://ofbiz.apache.org/security.html related
- https://ofbiz.apache.org/release-notes-18.12.11.html release-notes
- https://issues.apache.org/jira/browse/OFBIZ-12875 issue-tracking
- https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q vendor-advisory
- http://www.openwall.com/lists/oss-security/2023/12/26/2