Affected versions:
- Apache OFBiz before 18.12.17
Description:
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request
Forgery (CSRF), : Improper Neutralization of Special Elements Used in a
Template Engine vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.17.
Users are recommended to upgrade to version 18.12.17, which fixes the issue.
Credit:
Sebastiano Sartor <s...@sebsrt.xyz> (finder)
Ryan <marimoo....@gmail.com> (finder)
References:
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://issues.apache.org/jira/browse/OFBIZ-13162
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-48962
