Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <17467868-fa5b-3cc5-e411-585bacf9d187@apache.org>
Date: Tue, 03 Sep 2024 17:05:34 +0000
From: Jacques Le Roux <jleroux@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-45195: Apache OFBiz: Confused controller-view
 authorization logic (forced browsing) 

Severity: important

Affected versions:

- Apache OFBiz before 18.12.16

Description:

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Credit:

shin24 from National Cyber Security Vietnam (finder)
LuanPV from National Cyber Security Vietnam (finder)
Ryan Emmons, Lead Security Researcher at Rapid7 (finder)
Hasib Vhora, Senior Threat Researcher, SonicWall (finder)
Xenc from SGLAB of Legendsec at Qi'anxin Group (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13130
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45195

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.