CVE-2024-47208: Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

[Jacques Le Roux <jleroux () apache org>]

Severity: important

Affected versions:

- Apache OFBiz before 18.12.17

Description:

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache 
OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Credit:

孙相 (Sun Xiang) (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13158
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-47208