CVE-2023-50968: Apache OFBiz: Arbitrary file properties reading and SSRF attack
Published Dec 26, 2023
·Updated
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.
The same uri can be operated to realize a SSRF attack also without authorizations.
Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Affected Software
1 affected component
Apache OFBiz<18.12.11
Remediation
Patch Available
Event History
Dec 26, 2023
CVE Published
11:45 AM
Data Sourced
11:45 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-50968?
CVE-2023-50968 has a high severity rating due to its potential for unauthorized file access and SSRF attacks.
2
How do I fix CVE-2023-50968?
To fix CVE-2023-50968, users should upgrade to Apache OFBiz version 18.12.1 or later.
3
What types of attacks can CVE-2023-50968 enable?
CVE-2023-50968 can enable arbitrary file properties reading and server-side request forgery (SSRF) attacks.
4
What versions of Apache OFBiz are affected by CVE-2023-50968?
Apache OFBiz versions prior to 18.12.1 are affected by CVE-2023-50968.
5
Is authentication required to exploit CVE-2023-50968?
No, CVE-2023-50968 can be exploited without authentication.