PT-2024-1832 · Apache · Apache Ofbiz

Arun Shaji · Published 2024-01-17 · Updated 2024-09-17 · CVE-2024-23946

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.12

Description The issue concerns a possible path traversal in Apache OFBiz, allowing file inclusion. This vulnerability may enable remote attackers to disclose sensitive information on affected installations of Apache OFBiz. Authentication is not required to exploit this vulnerability.

Recommendations For versions prior to 18.12.12, upgrade to version 18.12.12 to fix the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Path traversal

Information Disclosure

Unrestricted File Upload

Weakness Enumeration

CWE-209

CWE-22

CWE-200

CWE-434

Related Identifiers

BDU:2024-01577

CVE-2024-23946

ZDI-24-183

Affected Products

Apache Ofbiz

References · 23

• https://zerodayinitiative.com/advisories/ZDI-24-183 · Security Note
• https://issues.apache.org/jira/browse/OFBIZ-12884 · Vendor Advisory
• https://ofbiz.apache.org/security.html · Vendor Advisory
• https://lists.apache.org/thread/w4lp5ncpzttf41hn5bsc04mzq4o6lw3g · Vendor Advisory
• https://ofbiz.apache.org/release-notes-18.12.12.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23946 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23946 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01577 · Security Note
• https://ofbiz.apache.org/download.html · Patch
• https://twitter.com/fofabot/status/1763143080549687744 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1763024042087612530 · Twitter Post
• https://t.me/cvenotify/90397 · Telegram Post
• https://vuldb.com/ru/?id.254439 · Note
• https://cybersecurity-help.cz/vdb/SB2024022314 · Note
• http://openwall.com/lists/oss-security/2024/02/28/9 · Note