High severity · published Dec 26, 2023
CVE-2023-50968
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations
7.5
CVSS
63.4%
EPSS
No
On KEV
Description
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.
The same uri can be operated to realize a SSRF attack also without authorizations.
Users are recommended to upgrade to version 18.12.11, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)63.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
before 18.12.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50968
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50968
Mailing List
http://www.openwall.com/lists/oss-security/2023/12/26/2
Issue Tracking
https://issues.apache.org/jira/browse/OFBIZ-12875
Mailing List
https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q
Product
https://ofbiz.apache.org/download.html
Release Notes
https://ofbiz.apache.org/release-notes-18.12.11.html
Vendor Advisory
https://ofbiz.apache.org/security.html
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin