CVE-2024-48962

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-48962

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48962.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-48962

Published

2024-11-18T09:15:06.237Z

Modified

2025-11-20T12:30:55.519899Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

References

Affected packages

Git / github.com/apache/ofbiz-framework

Affected ranges

Type: GIT
Repo: https://github.com/apache/ofbiz-framework
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

de26aaebb484c7fdfe84b0efff52f31f8db5be8b

Affected versions

release18.*

release18.12.01

release18.12.02

release18.12.03

release18.12.04

release18.12.05

release18.12.12

release18.12.13

release18.12.14

release18.12.15

release18.12.16

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "source": "https://github.com/apache/ofbiz-framework/commit/de26aaebb484c7fdfe84b0efff52f31f8db5be8b",
        "id": "CVE-2024-48962-9048333d",
        "target": {
            "file": "framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java"
        },
        "digest": {
            "line_hashes": [
                "268215389722916780072752905709993071595",
                "72136195450045075206319979647219152032",
                "181264313544151007732775693074295873517",
                "93960116769335446761655391902023714966",
                "217507038410962844802309931952239942959",
                "24171756950230375222347960752134388727",
                "316012611924514013275513455410669685558",
                "87565119657311514175498015628156271882",
                "181841176671535526380051687255529956250",
                "187329757823691350107530516368996696981",
                "210543442766242532908732471584737940369",
                "265781397401453482975390167582040181424",
                "29589816832726719752102625500018711432",
                "256349042954607276767925603872077936736",
                "108139071904062632680832392340365260799",
                "335305148043535432646762874123646216445",
                "217591771284296877329362234353387372758",
                "273989156678013918345959546338114783399",
                "89838397603860580025988618135894812267",
                "325480601185209305243735006882827634971",
                "293057097025287615469664068651953394650",
                "41525946027051173530833912588250269730",
                "157331585613933394395632847520466994166",
                "251168313837008601648087239271108039924"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://github.com/apache/ofbiz-framework/commit/de26aaebb484c7fdfe84b0efff52f31f8db5be8b",
        "id": "CVE-2024-48962-b1f5af64",
        "target": {
            "file": "framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java",
            "function": "doFilter"
        },
        "digest": {
            "function_hash": "301889429843062611727424886954573430299",
            "length": 2649.0
        },
        "signature_type": "Function",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48962.json"