Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE
80Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.8epss 93%
from disclosure to weapon
Published on NVDSep 4
VulnCheck+92d
exploitation probability
93%top 1% of all CVEs
observed exploitation
yesVulnCheck
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache OFBiz