CVE-2023-50968CWE-200CWE-918

Apache OFBiz: Arbitrary file properties reading and SSRF attack

published December 26, 2023

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.2th percentile for exploit probability.

CVSS
—
EPSS
63%
Percentile
99.2
In the wild
Unconfirmed
What it is

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

The same uri can be operated to realize a SSRF attack also without authorizations.

Users are recommended to upgrade to version 18.12.11, which fixes this issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.63373 · 99.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-12-26T11:45Z
EPSS history
Timeline
  • 26 DEC 11:45Z
    Apache OFBiz: Arbitrary file properties reading and SSRF attack
    cvelistv5