Vulnerability · Published Nov 18, 2024 · Assigned by apache

CVE-2024-48962Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

High 8.9

In plain English

A high-severity code injection in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High

Exploit odds (30 days)0.6%top 48.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	0 – before 18.12.17

Weakness: CWE-94, CWE-352, CWE-1336 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/V:C/RE:H/U:Amber

References

https://ofbiz.apache.org/download.html mitigation, release-notes, product
https://ofbiz.apache.org/security.html patch
https://issues.apache.org/jira/browse/OFBIZ-13162 issue-tracking
https://lists.apache.org/thread/6sddh4pts90cp8ktshqb4xykdp6lb6q6 vendor-advisory
http://www.openwall.com/lists/oss-security/2024/11/16/2