Detections
Analytics
Apache OFBiz < 18.12.16 Remote Code Execution
high Web App Scanning Plugin ID 114444
Synopsis
Apache OFBiz < 18.12.16 Remote Code ExecutionDescription
Apache OFBiz versions prior to 18.12.16 suffers from a vulnerability allowing a remote and unauthenticated attacker to arbitrary write file to the target instance and Remote Code Execution (RCE) on the vulnerable system.Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration.
Solution
Upgrade to Apache OFBiz version 18.12.16 or later.See Also
Plugin Details
Severity: High
ID: 114444
Type: remote
Family: Component Vulnerability
Published: 9/26/2024
Updated: 9/26/2024
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 6.1
CVSS v2
Risk Factor: High
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2024-45195
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score Source: CVE-2024-45195
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/3/2024
Vulnerability Publication Date: 9/3/2024
Reference Information
CVE: CVE-2024-45195
OWASP: 2010-A4, 2010-A6, 2013-A4, 2013-A5, 2013-A9, 2017-A5, 2017-A6, 2017-A9, 2021-A1, 2021-A10, 2021-A6
WASC: Application Misconfiguration, Information Leakage, Predictable Resource Location
CAPEC: 116, 127, 13, 169, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 472, 497, 508, 573, 574, 575, 576, 577, 59, 60, 616, 643, 646, 651, 79, 87
DISA STIG: APSC-DV-000460, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-15
OWASP API: 2019-API7, 2023-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.2.6, 4.0.2-8.3.4