[<prev] [next>] [day] [month] [year] [list]
Message-ID: <17467868-fa5b-3cc5-e411-585bacf9d187@apache.org>
Date: Tue, 03 Sep 2024 17:05:34 +0000
From: Jacques Le Roux <jleroux@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-45195: Apache OFBiz: Confused controller-view
authorization logic (forced browsing)
Severity: important
Affected versions:
- Apache OFBiz before 18.12.16
Description:
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Credit:
shin24 from National Cyber Security Vietnam (finder)
LuanPV from National Cyber Security Vietnam (finder)
Ryan Emmons, Lead Security Researcher at Rapid7 (finder)
Hasib Vhora, Senior Threat Researcher, SonicWall (finder)
Xenc from SGLAB of Legendsec at Qi'anxin Group (finder)
References:
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13130
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45195
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
