Description

OFBiz allows an unauthenticated attacker to send arbitrary requests to perform lookups on the internal network which is otherwise not accessible externally. An attacker may use this feature to perform SSRF (server-side request forgery) attacks on the server.

Remediation

Upgrade to the latest version of OFBiz

References

Release Notes 18.12.11

Related Vulnerabilities

XWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2022-23618)

MySQL CVE-2022-21351 Vulnerability (CVE-2022-21351)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-2572)

Internet Information Services Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-1999-0349)

PHP Resource Management Errors Vulnerability (CVE-2010-4150)

Severity

High

Classification

CVE-2023-50968 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Tags

Acumonitor SSRF Known Vulnerabilities