PT-2024-5990 · Apache · Apache Ofbiz

孙相 · Published 2024-08-14 · Updated 2026-01-02 · CVE-2024-45507

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.16

Description The issue is related to Server-Side Request Forgery (SSRF) and Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This vulnerability may allow a remote attacker to perform an SSRF attack. Over 2,700 results have been found to be potentially affected.

Recommendations For Apache OFBiz versions prior to 18.12.16, upgrade to version 18.12.16, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable components until a patch is applied. Avoid using URLs in files when loading them from Java or Groovy to prevent potential exploitation.

Fix

RCE

SSRF

Code Injection

Weakness Enumeration

CWE-918

CWE-94

Related Identifiers

BDU:2024-06799

CVE-2024-45507

Affected Products

Apache Ofbiz

References · 26

• https://osv.dev/vulnerability/CVE-2024-45507 · Vendor Advisory
• https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy · Vendor Advisory
• https://issues.apache.org/jira/browse/OFBIZ-13132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45507 · Security Note
• https://bdu.fstec.ru/vul/2024-06799 · Security Note
• https://twitter.com/cracbot/status/1832660264283729953 · Twitter Post
• https://twitter.com/AegisLens/status/1831769564360655094 · Twitter Post
• https://twitter.com/pravin_karthik/status/1834502840808796634 · Twitter Post
• https://twitter.com/byt3n33dl3/status/1862437952644890941 · Twitter Post
• https://t.me/cvenotify/93168 · Telegram Post
• https://twitter.com/SecAideInfo/status/1831999040797761685 · Twitter Post
• https://twitter.com/CVEnew/status/1831251196646142172 · Twitter Post
• https://ofbiz.apache.org/download.html · Note
• https://twitter.com/r0otk3r/status/2007175291760959680 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/03/7 · Note