CVE-2023-51467

Опубликовано: 26 дек. 2023

Источник: nvd

CVSS3: 9.8

EPSS Критический

Описание

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

Ссылки

https://issues.apache.org/jira/browse/OFBIZ-12873
Issue Tracking
Patch
Vendor Advisory
https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
Mailing List
Vendor Advisory
https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o
Mailing List
Vendor Advisory
https://ofbiz.apache.org/download.html
Product
https://ofbiz.apache.org/release-notes-18.12.11.html
Release Notes
https://ofbiz.apache.org/security.html
Not Applicable
https://www.openwall.com/lists/oss-security/2023/12/26/3
https://issues.apache.org/jira/browse/OFBIZ-12873
Issue Tracking
Patch
Vendor Advisory
https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
Mailing List
Vendor Advisory
https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o
Mailing List
Vendor Advisory
https://ofbiz.apache.org/download.html
Product
https://ofbiz.apache.org/release-notes-18.12.11.html
Release Notes
https://ofbiz.apache.org/security.html
Not Applicable
https://www.openwall.com/lists/oss-security/2023/12/26/3
https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*

Версия до 18.12.11 (исключая)

EPSS

Процентиль: 100%

0.93996

Критический

9.8 Critical

CVSS3

Дефекты

CWE-918

Связанные уязвимости

GHSA-9699-fmx5-wvpf

github

около 2 лет назад

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)

BDU:2023-09144

CVSS3: 8.1

fstec