8.9
High
CVE-2024-48962 Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper…
Description
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OFBiz 18.12 | earliest → < 18.12.17 | 18.12.17 |
| OFBiz 18.12 | earliest → < 18.12.17 | 18.12.17 |
References
- ofbiz.apache.org ofbiz.apache.org
- ofbiz.apache.org ofbiz.apache.org
- issues.apache.org issues.apache.org
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache OFBiz
The 97 CVEs of Apache OFBiz →
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
Not rated
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA component
Not rated
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
Not rated
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Not rated