Critical Vulnerability in Apache OFBiz

Apache has released updates addressing a critical vulnerability (CVE-2023-51467) in their OFBiz Enterprise Resource Planning (ERP) system. The vulnerability has a Common Vulnerability Scoring System (CVSS) score of 9.8 out of 10.

Successful exploitation of this authentication bypass vulnerability could allow an attacker to achieve a Server-Side Request Forgery (SSRF) and perform remote code execution.

The vulnerability affects all Apache OFBIZ versions 18.12.10 and earlier.

Users and administrators of affected products are advised to update to the latest product versions immediately.

More information is available here:

https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv

https://issues.apache.org/jira/browse/OFBIZ-12873

https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/