PT-2024-8600 · Apache · Apache Ofbiz

孙相 · Published 2024-11-16 · Updated 2024-11-22 · CVE-2024-47208

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.17

Description The issue is related to Server-Side Request Forgery (SSRF) and Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This vulnerability may allow a remote attacker to perform an SSRF attack. Users are recommended to upgrade to a fixed version to resolve the issue.

Recommendations For Apache OFBiz versions prior to 18.12.17, upgrade to version 18.12.17, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable components until a patch is applied.

Fix

SSRF

Code Injection

Weakness Enumeration

CWE-918

CWE-94

Related Identifiers

BDU:2024-10169

CVE-2024-47208

Affected Products

Apache Ofbiz

References · 21

• https://lists.apache.org/thread/022r19skfofhv3lzql33vowlrvqndh11 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47208 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47208 · Vendor Advisory
• https://twitter.com/Dinosn/status/1859108914844868645 · Twitter Post
• https://issues.apache.org/jira/browse/OFBIZ-13158 · Note
• https://sangfor.com/farsight-labs-threat-intelligence/cybersecurity/cve-2024-47208-apache-ofbiz-remote-code-execution · Note
• https://twitter.com/fridaysecurity/status/1859050300293959864 · Twitter Post
• https://ofbiz.apache.org/download.html · Note
• https://twitter.com/the_yellow_fall/status/1859048531241431527 · Twitter Post
• https://t.me/pentestingnews/53416 · Telegram Post
• https://github.com/advisories/GHSA-qxp5-vjrm-298x · Note
• https://twitter.com/CVEnew/status/1858431581167525933 · Twitter Post
• https://twitter.com/OstorlabSec/status/1860001117842645174 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857809474158744059 · Twitter Post