Paper/Archive/CVE-2024-45507

CVE-2024-45507

Apache Software Foundation Apache OFBiz — Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

EPSS 96%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 99.9.999 × 2020.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache OFBiz< 18.12.1618.12.16CNA

apache_ofbiz< 18.12.1618.12.16CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADP8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refofbiz.apache.org/download.html patchofbiz.apache.org/security.html refissues.apache.org/jira/browse/OFBIZ-13132 advisorylists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy refopenwall.com/lists/oss-security/2024/09/03/7