PT-2024-5990 · Apache · Apache Ofbiz

孙相 · CVE-2024-45507 · Published 2024-08-14 · Updated 2026-01-02

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.16

Description The issue is related to Server-Side Request Forgery (SSRF) and Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This vulnerability may allow a remote attacker to perform an SSRF attack. Over 2,700 results have been found to be potentially affected.

Recommendations For Apache OFBiz versions prior to 18.12.16, upgrade to version 18.12.16, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable components until a patch is applied. Avoid using URLs in files when loading them from Java or Groovy to prevent potential exploitation.

Exploit

Fix

RCE

Code Injection

SSRF

Weakness Enumeration

CWE-94

CWE-918

Related Identifiers

BDU:2024-06799

CVE-2024-45507

Affected Products

Apache Ofbiz

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45507.json · Exploit
• https://bdu.fstec.ru/vul/2024-06799 · Security Note
• https://issues.apache.org/jira/browse/OFBIZ-13132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45507 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45507 · Vendor Advisory
• https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy · Vendor Advisory
• https://twitter.com/CVEnew/status/1831251196646142172 · Twitter Post
• https://twitter.com/oss_security/status/1831061774441001341 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/03/7 · Note
• https://t.me/cvedetector/4778 · Telegram Post
• https://twitter.com/SecAideInfo/status/1831999040797761685 · Twitter Post
• https://twitter.com/pravin_karthik/status/1834502840808796634 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1831068324005872015 · Twitter Post
• https://twitter.com/chybeta/status/1833375265852108929 · Twitter Post
• https://twitter.com/r0otk3r/status/2007175291760959680 · Twitter Post