CVE-2020-13923
First published: Wed Jul 15 2020(Updated: )
IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OFBiz | <17.12.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r2e669797c1ea08562253239d2dc4192d951945e0c36cb0754f5394a6@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rac7e36c3daa60dd4b813f72942921b4fad71da821480ebcea96ecea1@%3Cnotifications.ofbiz.apache.org%3E
- https://s.apache.org/chokl
- https://lists.apache.org/thread.html/r2e669797c1ea08562253239d2dc4192d951945e0c36cb0754f5394a6%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rac7e36c3daa60dd4b813f72942921b4fad71da821480ebcea96ecea1%40%3Cnotifications.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-13923.
What is the severity of CVE-2020-13923?
The severity of CVE-2020-13923 is medium with a severity score of 5.3.
What is the affected software for CVE-2020-13923?
The affected software for CVE-2020-13923 is Apache OFBiz before version 17.12.04.
What is IDOR vulnerability?
IDOR vulnerability stands for Insecure Direct Object Reference vulnerability, which occurs when an application uses user-supplied input to access objects directly without any proper authorization.
How do I fix CVE-2020-13923?
To fix CVE-2020-13923, it is recommended to update Apache OFBiz to version 17.12.04 or higher.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- agent/source
- vendor/apache
- canonical/apache ofbiz