CVE-2023-50968
Assigner: apache
Published: 2023-12-26T11:45:55.393Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache OFBiz
vendor: Apache Software Foundation
versions: lessThanOrEqual: 18.12.10
status: affected
version: 0
versionType: custom
credits: type: finder
value: Yun Peng - 郭 运鹏 <puata123@outlook.com>
descriptions: supportingMedia: base64: no
type: text/html
value: <div>Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.<br></div><div><br></div><div>The same uri can be operated to realize a SSRF attack also  without  authorizations.<br></div><div><br></div>Users are recommended to upgrade to version 18.12.11, which fixes this issue.
value: Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

The same uri can be operated to realize a SSRF attack also  without  authorizations.

Users are recommended to upgrade to version 18.12.11, which fixes this issue.
metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
descriptions: cweId: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
type: CWE
source: discovery: EXTERNAL
title: Apache OFBiz: Arbitrary file properties reading and SSRF attack
x_generator: engine: Vulnogram 0.1.0-dev