oss-sec mailing list archives

CVE-2024-45507: Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

From: Jacques Le Roux <jleroux () apache org>
Date: Tue, 03 Sep 2024 17:05:47 +0000

Severity: important

Affected versions:

- Apache OFBiz before 18.12.16

Description:

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache 
OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Credit:

孙相 (Sun Xiang) (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13132
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45507

Current thread:

CVE-2024-45507: Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE Jacques Le Roux (Sep 03)