What’s Vulnerable › Vulnerabilities

CVE-2024-48962: Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-18 · updated 2026-06-17
• Weakness: CWE-94

Description

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Affected products

• Apache Software Foundation Apache OFBiz: before 18.12.17 — fixed in 18.12.17

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OFBiz 18.12.17. Check the vendor advisory for mitigations.

References

• https://issues.apache.org/jira/browse/OFBIZ-13162
• https://lists.apache.org/thread/6sddh4pts90cp8ktshqb4xykdp6lb6q6
• https://ofbiz.apache.org/download.html
• https://ofbiz.apache.org/security.html
• http://www.openwall.com/lists/oss-security/2024/11/16/2

Get alerted when CVE-2024-48962 or the next vulnerability affects your stack