CVE-2023-50968
HIGH EXPLOITED NUCLEIApache Ofbiz < 18.12.11 - Information Disclosure
Title source: ruleDescription
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Nuclei Templates (1)
Apache OFBiz < 18.12.11 - Server Side Request Forgery
HIGHVERIFIEDby your3cho
Shodan:
html:"OFBiz" || http.html:"ofbiz" || ofbiz.visitor=
FOFA:
app="Apache_OFBiz" || body="ofbiz" || app="apache_ofbiz"
References (6)
Scores
CVSS v3
7.5
EPSS
0.8390
EPSS Percentile
99.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
VulnCheck KEV
2024-01-21
CWE
CWE-918
CWE-200
Status
published
Products (1)
apache/ofbiz
< 18.12.11
Published
Dec 26, 2023
Tracked Since
Feb 18, 2026