Description

OFBiz allows an unauthenticated attacker to send arbitrary requests to perform lookups on the internal network which is otherwise not accessible externally. An attacker may use this feature to perform SSRF (server-side request forgery) attacks on the server.

Remediation

Upgrade to the latest version of OFBiz

References

Release Notes 18.12.11

Related Vulnerabilities

Drupal Incorrect Authorization Vulnerability (CVE-2022-25270)

MySQL Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2009-4030)

MySQL CVE-2010-3834 Vulnerability (CVE-2010-3834)

MODX Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-4883)

Envoy Proxy Uncontrolled Resource Consumption Vulnerability (CVE-2019-15226)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Tags

Acumonitor SSRF Known Vulnerabilities CWE-918 CVE-2023-50968