2024-003: Critical Vulnerability in Apache OFBiz

2024-003: Critical Vulnerability in Apache OFBiz ↗ source

January 9, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-003/

Summary

The vulnerability allows attackers to bypass authentication, which could lead to remote code execution (RCE) [1]. The vulnerability, identified as CVE-2023-51467 with a CVSS score of 9.8 [2], may allow an attacker to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF). A successful exploit may allow the attacker to perform remote code execution. This vulnerability affects Apache OFBiz versions below 18.12.11 [3,4]. It is recommended to upgrade to version 18.21.11 as soon as possible.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2023-51467	—	Apache Software Foundation Apache OFBiz The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Apache 40 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.