PT-2023-8030 · Apache · Apache Ofbiz

Yun Peng + 1 · Published 2023-12-26 · Updated 2024-01-04 · CVE-2023-50968

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.11

Description The issue is related to insufficient validation of incoming requests, allowing a remote attacker to perform a Server-Side Request Forgery (SSRF) attack by sending a specially crafted HTTP request. This can also lead to arbitrary file properties reading vulnerability when a user operates a URI call without proper authorizations. The same URI can be exploited to realize a SSRF attack without authorizations.

Recommendations For versions prior to 18.12.11, upgrade to version 18.12.11 to fix the issue. As a temporary workaround, consider restricting access to unauthorized URI calls to minimize the risk of exploitation. Avoid operating URI calls without proper authorizations until the issue is resolved.

Fix

SSRF

Information Disclosure

Weakness Enumeration

CWE-918

CWE-200

Related Identifiers

BDU:2024-00007

CVE-2023-50968

Affected Products

Apache Ofbiz

References · 21

• https://ofbiz.apache.org/security.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50968 · Security Note
• https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50968 · Vendor Advisory
• https://issues.apache.org/jira/browse/OFBIZ-12875 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00007 · Security Note
• https://t.me/cvenotify/66150 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1739641356849500579 · Twitter Post
• https://ofbiz.apache.org/release-notes-18.12.11.html · Note
• https://twitter.com/cipherstorm/status/1740061008629256195 · Twitter Post
• https://t.me/cvenotify/65137 · Telegram Post
• https://twitter.com/DhiyaneshDK/status/1742094028202463494 · Twitter Post
• http://openwall.com/lists/oss-security/2023/12/26/2 · Note
• https://twitter.com/oss_security/status/1739673046917517714 · Twitter Post
• https://twitter.com/RedPacketSec/status/1739950213681348948 · Twitter Post