CVE-2024-48962

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-48962

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48962.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-48962

Published

2024-11-18T08:41:30.545Z

Modified

2026-07-22T03:35:42.034159Z

Severity

8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/V:C/RE:H/U:Amber CVSS Calculator

Summary

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Details

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-1336",
        "CWE-352",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48962.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "18.12.17"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "18.12.17"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/ofbiz-framework

Affected ranges

Type

GIT

Repo

https://github.com/apache/ofbiz-framework

Events

Introduced

Fixed

de26aaebb484c7fdfe84b0efff52f31f8db5be8b

Database specific

{
    "cpe": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.12.17"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

release18.*

release18.12.01

release18.12.02

release18.12.03

release18.12.04

release18.12.05

release18.12.12

release18.12.13

release18.12.14

release18.12.15

release18.12.16

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://github.com/apache/ofbiz-framework/commit/de26aaebb484c7fdfe84b0efff52f31f8db5be8b",
        "deprecated": false,
        "target": {
            "file": "framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java"
        },
        "id": "CVE-2024-48962-9048333d",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "268215389722916780072752905709993071595",
                "72136195450045075206319979647219152032",
                "181264313544151007732775693074295873517",
                "93960116769335446761655391902023714966",
                "217507038410962844802309931952239942959",
                "24171756950230375222347960752134388727",
                "316012611924514013275513455410669685558",
                "87565119657311514175498015628156271882",
                "181841176671535526380051687255529956250",
                "187329757823691350107530516368996696981",
                "210543442766242532908732471584737940369",
                "265781397401453482975390167582040181424",
                "29589816832726719752102625500018711432",
                "256349042954607276767925603872077936736",
                "108139071904062632680832392340365260799",
                "335305148043535432646762874123646216445",
                "217591771284296877329362234353387372758",
                "273989156678013918345959546338114783399",
                "89838397603860580025988618135894812267",
                "325480601185209305243735006882827634971",
                "293057097025287615469664068651953394650",
                "41525946027051173530833912588250269730",
                "157331585613933394395632847520466994166",
                "251168313837008601648087239271108039924"
            ]
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/apache/ofbiz-framework/commit/de26aaebb484c7fdfe84b0efff52f31f8db5be8b",
        "deprecated": false,
        "target": {
            "file": "framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java",
            "function": "doFilter"
        },
        "id": "CVE-2024-48962-b1f5af64",
        "signature_type": "Function",
        "digest": {
            "length": 2649.0,
            "function_hash": "301889429843062611727424886954573430299"
        }
    }
]

vanir_signatures_modified

"2026-07-22T03:35:42Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48962.json"