Vulnerabilities

TI-2024-31564 CVE-2024-47208 · GHSA-qxp5-vjrm-298x

Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

MEDIUM 52

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01598 Published 2024-11-18 Fixed in 18.12.17 CWE-918

TI-2024-32647 CVE-2024-48962 · GHSA-ffrw-8p66-394j

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

MEDIUM 41

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

CVSS 4.0HIGH 8.9 Network No auth User interaction EPSS 0.00646 Published 2024-11-18 Fixed in 18.12.17 CWE-1336

Vulnerabilities

Filters

Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)