CVE-2023-50968

—

CVSS 3.1

7.5 high

EPSS

63%p99

Published

Dec 26, 2023 (Dec 26, 2023)

Modified

Jun 17, 2026

Description

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.

Vendors: apache
Products: ofbiz
Weakness: CWE-200, CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (63.4%)

In the news0 stories

No ingested article mentions this CVE yet.