CVE-2024-48962

HIGH

Apache Ofbiz < 18.12.17 - CSRF

Title source: rule

Description

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

References (5)

[Issue Tracking] https://issues.apache.org/jira/browse/OFBIZ-13162

[Mailing List] https://lists.apache.org/thread/6sddh4pts90cp8ktshqb4xykdp6lb6q6

[Product] https://ofbiz.apache.org/download.html

[Vendor Advisory] https://ofbiz.apache.org/security.html

[Mailing List] http://www.openwall.com/lists/oss-security/2024/11/16/2

Scores

CVSS v3 8.8

EPSS 0.0024

EPSS Percentile 47.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-352 CWE-94 CWE-1336

Status published

Affected Products (1)

apache/ofbiz < 18.12.17

Timeline

Published Nov 18, 2024

Tracked Since Feb 18, 2026