CVE-2023-51467

EPSS 94%
Published 26.12.2023 15:15:08
Last modified 21.11.2024 08:38:11
Source security@apache.org
Teams watchlist Login
Open Login

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

Affected products Warnungen 0 Metrics 2 CWE 1 References 11

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Ofbiz Version < 18.12.11

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	94%	0.999

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://ofbiz.apache.org/security.html

Not Applicable

https://ofbiz.apache.org/download.html

Product

https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467

https://ofbiz.apache.org/release-notes-18.12.11.html

Release Notes

https://issues.apache.org/jira/browse/OFBIZ-12873

Patch

Vendor Advisory

Issue Tracking

https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv

Vendor Advisory

Mailing List

https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o

Vendor Advisory

Mailing List

https://www.openwall.com/lists/oss-security/2023/12/26/3

https://nvd.nist.gov/vuln/detail/CVE-2023-51467

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-51467

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-51467

EUVD