CVE-2023-50968 Apache OFBiz: Arbitrary file properties reading and SSRF attack

2023-12-2611:45:55

CWE-918

CWE-200

apache

www.cve.org

cve-2023-50968

apache ofbiz

arbitrary file properties

reading vulnerability

ssrf attack

apache software foundation

authorization

upgrade to version 18.12.11

0.29 Low

EPSS

Percentile

96.9%

JSON

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

The same uri can be operated to realize a SSRF attack also without authorizations.

Users are recommended to upgrade to version 18.12.11, which fixes this issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache OFBiz",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "18.12.10",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]