CVE-2024-48962
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Summary
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), and Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz versions before 18.12.17.
Impact
This vulnerability has a high severity with a CVSS v4 base score of 8.9. It potentially allows attackers to execute arbitrary code, perform cross-site request forgery attacks, and exploit template engine vulnerabilities. The impact on vulnerable systems is high for confidentiality, integrity, and availability. Moreover, the subsequent system impact is also high for confidentiality, integrity, and availability, indicating potential for significant damage beyond the initial compromise.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Users are recommended to upgrade to Apache OFBiz version 18.12.17, which fixes the issue.
Mitigation
The primary mitigation is to upgrade to Apache OFBiz version 18.12.17. If immediate upgrading is not possible, consider implementing additional security controls such as web application firewalls, input validation, and output encoding to minimize the risk of exploitation. Regularly monitor for any suspicious activities and implement strong authentication mechanisms to prevent unauthorized access.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber
Timeline
Feedly found the first article mentioning CVE-2024-48962. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-48962
A CVSS base score of 8.9 has been assigned.
Detection for the vulnerability has been added to Qualys (731916)
Detection for the vulnerability has been added to Qualys (152420)
EPSS Score was set to: 0.05% (Percentile: 17%)
A CVSS base score of 7.5 has been assigned.