CVE-2024-48962

published 2024-11-18

CVE-2024-48962: Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template…

high 8.9 CVSS 4.0

AV N AC H AT P PR N UI A VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V C RE H U Amber

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	ofbiz	< 18.12.17	18.12.17
apache	ofbiz	—	—
apache_software_foundation	apache_ofbiz	< 18.12.17	18.12.17

CWE-94 CWE-352 CWE-1336