CVE-2024-48962CWE-1336CWE-352CWE-94

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

High · published November 18, 2024

CVSS v4.0
8.9
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/V:C/RE:H/U:Amber
EPSS
0.00609 · 48.5th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-352 · Cross-Site Request Forgery (CSRF); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-11-18T08:41Z
EPSS history
Timeline
  • 18 NOV 08:41Z
    Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
    cvelistv5