CVE-2023-50968

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Dec 26, 2023
Updated: Jan 4, 2024
CWE ID 918
CWE ID 200

Summary

CVE-2023-50968 is a vulnerability affecting Apache Software Foundation's Apache OFBiz. An arbitrary file properties reading issue arises when users access a URI without proper authorizations. This vulnerability can also be exploited for Server Side Request Forgery (SSRF) attacks without authorizations. It is strongly advised that users upgrade to version 18.12.11 to mitigate this risk and resolve the issue.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Apache Software Foundation OFBiz
  • Apache OFBiz

Affected Vendors

  • Apache Software Foundation

Advisories, Assessments, and Mitigations