CVE-2024-45195: Apache OFBiz: Confused controller-view authorization logic (forced browsing)

[Jacques Le Roux <jleroux () apache org>]

Severity: important

Affected versions:

- Apache OFBiz before 18.12.16

Description:

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Credit:

shin24 from National Cyber Security Vietnam (finder)
LuanPV from National Cyber Security Vietnam (finder)
Ryan Emmons, Lead Security Researcher at Rapid7 (finder)
Hasib Vhora, Senior Threat Researcher, SonicWall (finder)
Xenc from SGLAB of Legendsec at Qi'anxin Group (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13130
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45195