CVE-2024-48962: Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

[Jacques Le Roux <jleroux () apache org>]

Affected versions:

- Apache OFBiz before 18.12.17

Description:

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization 
of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Credit:

Sebastiano Sartor <s () sebsrt xyz> (finder)
Ryan <marimoo.eth () gmail com> (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13162
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-48962