CVE-2024-47208

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-47208

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47208.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-47208

Published

2024-11-18T09:15:06.100Z

Modified

2026-04-12T09:38:26.912405Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

References

Affected packages

Git / github.com/apache/ofbiz-framework

Affected ranges

Type

GIT

Repo

https://github.com/apache/ofbiz-framework

Events

Introduced

Fixed

de26aaebb484c7fdfe84b0efff52f31f8db5be8b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.12.17"
        }
    ]
}

Affected versions

release18.*

release18.12.01

release18.12.02

release18.12.03

release18.12.04

release18.12.05

release18.12.12

release18.12.13

release18.12.14

release18.12.15

release18.12.16

Database specific

vanir_signatures_modified

"2026-04-12T09:38:26Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47208.json"

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "268215389722916780072752905709993071595",
                "72136195450045075206319979647219152032",
                "181264313544151007732775693074295873517",
                "93960116769335446761655391902023714966",
                "217507038410962844802309931952239942959",
                "24171756950230375222347960752134388727",
                "316012611924514013275513455410669685558",
                "87565119657311514175498015628156271882",
                "181841176671535526380051687255529956250",
                "187329757823691350107530516368996696981",
                "210543442766242532908732471584737940369",
                "265781397401453482975390167582040181424",
                "29589816832726719752102625500018711432",
                "256349042954607276767925603872077936736",
                "108139071904062632680832392340365260799",
                "335305148043535432646762874123646216445",
                "217591771284296877329362234353387372758",
                "273989156678013918345959546338114783399",
                "89838397603860580025988618135894812267",
                "325480601185209305243735006882827634971",
                "293057097025287615469664068651953394650",
                "41525946027051173530833912588250269730",
                "157331585613933394395632847520466994166",
                "251168313837008601648087239271108039924"
            ]
        },
        "target": {
            "file": "framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2024-47208-9048333d",
        "source": "https://github.com/apache/ofbiz-framework/commit/de26aaebb484c7fdfe84b0efff52f31f8db5be8b"
    },
    {
        "digest": {
            "length": 2649.0,
            "function_hash": "301889429843062611727424886954573430299"
        },
        "target": {
            "file": "framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java",
            "function": "doFilter"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2024-47208-b1f5af64",
        "source": "https://github.com/apache/ofbiz-framework/commit/de26aaebb484c7fdfe84b0efff52f31f8db5be8b"
    }
]