CVE-2026-71901highCWE-99

CVE-2026-71901: falha de alta gravidade em Apache OFBiz

Apache OFBiz: Dispatch arbitrary internal services on SFA component

Publicada em

Seguir esta CVE+ Monitorar Apache OFBiz

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.4%
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache OFBiz
CVEs relacionadas — Apache OFBiz

No mesmo produto, das mais perigosas para as menos.

CVE-2024-45195CRITICALApache OFBiz: Confused controller-view authorization logic (forced browsing)EPSS 100.0%KEVCVE-2024-32113CRITICALApache OFBiz: Path traversal leading to RCEEPSS 99.9%KEVCVE-2024-38856HIGHApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeEPSS 99.4%KEVCVE-2021-26295—RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIEPSS 97.8%CVE-2024-45507HIGHApache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCEEPSS 96.4%CVE-2023-51467—Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityEPSS 96.0%