PT-2023-8562 · Apache · Apache Ofbiz

Published 2023-11-07 · Updated 2024-09-04 · CVE-2023-46819

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.09

Description The issue is related to missing authentication in the Solr plugin of Apache OFBiz, allowing a remote attacker to modify protected information. It is estimated that around 1,891 devices are potentially affected, mainly located in the United States and China.

Recommendations For versions prior to 18.12.09, users are recommended to upgrade to version 18.12.09 to resolve the issue. As a temporary workaround, consider disabling the Solr plugin until the upgrade is applied.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-01169

CVE-2023-46819

Affected Products

Apache Ofbiz

References · 8

• https://osv.dev/vulnerability/CVE-2023-46819 · Vendor Advisory
• https://ofbiz.apache.org/security.html · Vendor Advisory
• https://lists.apache.org/thread/mm5j0rsbl22q7yb0nmb6h2swbfjbwv99 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46819 · Security Note
• https://ofbiz.apache.org/download.html · Note
• https://ofbiz.apache.org/release-notes-18.12.09.html · Note
• https://twitter.com/zoomeye_team/status/1722202629240234108 · Twitter Post