Jacques Le Roux

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.14 **Description** The issue affects Apache OFBiz due to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This vulnerability may allow a remote attacker to execute arbitrary code, potentially leading to full system compromise. Approximately 841 devices may be affected. **Recommendations** To resolve the issue, users are recommended to upgrade to version 18.12.14, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable directories until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 17.12.07 **Description** The issue is related to unsafe deserialization, which can allow a remote attacker to execute arbitrary code by sending a specially crafted request. This can potentially lead to the recovery of unreliable data in memory. **Recommendations** For versions prior to 17.12.07, update to version 17.12.07 or later to resolve the issue. As a temporary workaround, consider restricting access to the deserialization functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 17.12.06 **Description** The issue is related to unsafe deserialization in Apache OFBiz, allowing an unauthenticated attacker to take over the system. This can impact the confidentiality, integrity, and availability of protected information. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. A high severity remote code execution flaw in Apache OFBiz could have allowed attackers to take over the ERP system. **Recommendations** For Apache OFBiz versions prior to 17.12.06, update to version 17.12.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions 12.04.x through 12.04.05 Apache OFBiz versions 13.07.x through 13.07.02 **Description** The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library. **Recommendations** For Apache OFBiz versions 12.04.x through 12.04.05, update to version 12.04.06 or later. For Apache OFBiz versions 13.07.x through 13.07.02, update to version 13.07.03 or later.