[oss-security] CVE-2024-45507: Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

Tue, 03 Sep 2024 12:11:01 -0700 

Severity: important

Affected versions:

- Apache OFBiz before 18.12.16

Description:

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code 
('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Credit:

孙相 (Sun Xiang) (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13132
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45507

Reply via email to