CVE-2024-45507

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.16.Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Affected

Apache Software Foundation · Apache OFBiz

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

93.23% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-918

Published

2024-09-04

Updated

2024-09-13

Proof-of-concept exploits (1)

• Avento/CVE-2024-45507_Behinder_Webshell0★ · 2024-09-12

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45507.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/ofbiz/CVE-2024-45507

Security advisories

• https://issues.apache.org/jira/browse/OFBIZ-13132
• https://ofbiz.apache.org/security.html
• https://ofbiz.apache.org/download.html

References

• CVE Record
• NVD entry

Related

• CVE-2019-3396
• CVE-2021-38645
• CVE-2023-0669
• CVE-2023-22527
• CVE-2023-32031
• CVE-2023-43208