PT-2024-8602 · Apache · Apache Ofbiz

Marimoo.Eth + 2 · Published 2024-11-16 · Updated 2024-11-21 · CVE-2024-48962

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/V:C/RE:H/U:Amber

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.17

Description The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery (CSRF) and improper neutralization of special elements used in a template engine. This could potentially enable a remote attacker to perform a server-side request forgery (SSRF) attack.

Recommendations For versions prior to 18.12.17, upgrade to version 18.12.17 to fix the issue. As a temporary workaround, consider restricting access to vulnerable components until the upgrade can be applied.

Fix

Code Injection

CSRF

Weakness Enumeration

CWE-1336

CWE-94

CWE-352

Related Identifiers

BDU:2024-10171

CVE-2024-48962

Affected Products

Apache Ofbiz

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2024-48962 · Security Note
• https://lists.apache.org/thread/6sddh4pts90cp8ktshqb4xykdp6lb6q6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10171 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48962 · Vendor Advisory
• https://t.me/cvedetector/11300 · Telegram Post
• https://twitter.com/Dinosn/status/1859108914844868645 · Twitter Post
• https://github.com/advisories/GHSA-ffrw-8p66-394j · Note
• https://ofbiz.apache.org/security.html · Vendor Advisory, Patch
• https://twitter.com/VulmonFeeds/status/1857806914337276382 · Twitter Post
• https://cvedetails.com/cve/CVE-2024-48962 · Note
• https://twitter.com/fridaysecurity/status/1859050300293959864 · Twitter Post
• https://ofbiz.apache.org/download.html · Note
• https://twitter.com/CVEnew/status/1858431582362877958 · Twitter Post
• http://openwall.com/lists/oss-security/2024/11/16/2 · Note
• https://twitter.com/the_yellow_fall/status/1859048531241431527 · Twitter Post