apache Vulnerabilities and Affected Products

Products

HTTP Server21 vulnerabilities
OFBiz21 vulnerabilities
Struts18 vulnerabilities
inlong17 vulnerabilities
Tomcat16 vulnerabilities
airflow15 vulnerabilities
Solr10 vulnerabilities
traffic_server8 vulnerabilities
ActiveMQ7 vulnerabilities
linkis7 vulnerabilities
cloudstack6 vulnerabilities
cxf6 vulnerabilities
dolphinscheduler6 vulnerabilities
hertzbeat6 vulnerabilities
http_server6 vulnerabilities
pulsar6 vulnerabilities
streampark6 vulnerabilities
zeppelin6 vulnerabilities
Apache HTTP Server5 vulnerabilities
Apache Tomcat5 vulnerabilities
kafka5 vulnerabilities
ambari4 vulnerabilities
Apache OFBiz4 vulnerabilities
Apache Tika4 vulnerabilities
camel4 vulnerabilities

apache vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-48962HIGH	Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue. CWE-1336 CWE-352 CWE-94Nov 18, 2024	CVSS8.9v4.0	EPSS0.613%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-45195CRITICAL	Apache OFBiz: Confused controller-view authorization logic (forced browsing) Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. CWE-425Sep 4, 20241 related artifact	CVSS9.8v3.1	EPSS>99.9%	PoCs2	SignalsListed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-45507CRITICAL	Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. CWE-918 CWE-94Sep 4, 20241 related artifact	CVSS9.8v3.1	EPSS93.2%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-38856CRITICAL	Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints). CWE-863Aug 5, 20241 related artifact	CVSS9.8v3.1	EPSS99.4%	PoCs12	SignalsListed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-36104CRITICAL	Apache OFBiz: Path traversal leading to a RCE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue. CWE-22Jun 4, 20241 related artifact	CVSS9.1v3.1	EPSS87.4%	PoCs3	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-32113CRITICAL	Apache OFBiz: Path traversal leading to RCE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. CWE-22May 8, 20241 related artifact	CVSS9.8v3.1	EPSS99.4%	PoCs7	SignalsListed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-23946MEDIUM	Apache OFBiz: Path traversal or file inclusion Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue. CWE-22 CWE-434Feb 28, 2024	CVSS5.3v3.1	EPSS3.15%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-25065CRITICAL	Apache OFBiz: Path traversal allowing authentication bypass. Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue. CWE-22Feb 28, 2024	CVSS9.1v3.1	EPSS47.7%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-51467CRITICAL	Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code CWE-918Dec 26, 20231 related artifact	CVSS9.8v3.1	EPSS96%	PoCs11	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2023-50968HIGH	Apache OFBiz: Arbitrary file properties reading and SSRF attack Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue. CWE-200 CWE-918Dec 26, 20231 related artifact	CVSS7.5v3.1	EPSS63.4%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2023-49070CRITICAL	Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10 CWE-94Dec 5, 20231 related artifact	CVSS9.8v3.1	EPSS95.4%	PoCs5	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2022-47501HIGH	Apache OFBiz: Arbitrary file reading vulnerability Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07. CWE-22Apr 14, 20231 related artifact	CVSS7.5v3.1	EPSS10.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2021-30128CRITICAL	Unsafe deserialization in Apache OFBiz Apache OFBiz has unsafe deserialization prior to 17.12.07 version CWE-502Apr 27, 20211 related artifact	CVSS9.8v3.1	EPSS81.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2021-26295CRITICAL	RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. CWE-502Mar 22, 20211 related artifact	CVSS9.8v3.1	EPSS97.8%	PoCs5	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2020-9496MEDIUM	Apache OFBiz Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 CWE-502 CWE-79Jul 15, 20201 related artifact	CVSS6.1v3.1	EPSS98.9%	PoCs8	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2020-1943MEDIUM	Apache OFBiz Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. CWE-79Apr 1, 20201 related artifact	CVSS6.1v3.1	EPSS97.3%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2011-3600HIGH	Apache OFBiz Improper Restriction of XML External Entity Reference The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04. CWE-611Nov 26, 20191 related artifact	CVSS7.5v3.1	EPSS15.9%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2019-10074CRITICAL	An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533 CWE-116 CWE-20 CWE-74Sep 11, 2019	CVSS9.8v3.1	EPSS3.39%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2019-10073MEDIUM	The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616 CWE-79Sep 11, 2019	CVSS6.1v3.1	EPSS5.23%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2019-0189CRITICAL	The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually… CWE-502Sep 11, 2019	CVSS9.8v3.1	EPSS23.7%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2018-17200CRITICAL	The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r… Sep 11, 2019	CVSS9.8v3.1	EPSS5.03%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX