|
Message-ID: <17467868-fa5b-3cc5-e411-585bacf9d187@apache.org> Date: Tue, 03 Sep 2024 17:05:34 +0000 From: Jacques Le Roux <jleroux@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2024-45195: Apache OFBiz: Confused controller-view authorization logic (forced browsing) Severity: important Affected versions: - Apache OFBiz before 18.12.16 Description: Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. Credit: shin24 from National Cyber Security Vietnam (finder) LuanPV from National Cyber Security Vietnam (finder) Ryan Emmons, Lead Security Researcher at Rapid7 (finder) Hasib Vhora, Senior Threat Researcher, SonicWall (finder) Xenc from SGLAB of Legendsec at Qi'anxin Group (finder) References: https://ofbiz.apache.org/download.html https://ofbiz.apache.org/security.html https://issues.apache.org/jira/browse/OFBIZ-13130 https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-45195
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.