Apache OFBiz 24.09.08 patches multiple critical vulnerabilities
Multiple critical issues in Apache OFBiz before 24.09.08 have been fixed by upgrading to 24.09.08.
85
Vulnerability2 · 1 read
CVE-2026-68524
Unauthenticated Screen injection in Apache OFBiz before 24.09.08
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Temporary-file handling in Apache OFBiz lets an unauthenticated attacker reach an open file descriptor and inject a file: URI so the server loads an attacker-controlled Screen definition. That is improper control of code generation (CWE-94). Installations of Apache OFBiz before 24.09.08 are affected.
What to do: Upgrade Apache OFBiz to 24.09.08, which fixes the issue.
| Product | Affected | Fixed in |
|---|---|---|
| Apache OFBiz | before 24.09.08 | 24.09.08 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N