CVE-2024-47208

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-47215.4A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknoCVE-2024-472108.8Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelCVE-2024-472115.3In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lacCVE-2024-472127.5An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu ServerCVE-2024-472137.5An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon recCVE-2024-472147.5An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but involves a different kind of malicious payloadCVE-2024-472157.5An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS previewCVE-2024-472176.5An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but involves an authenticated endpoint. It can renCVE-2024-472189.8An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication.CVE-2024-472199.8An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection.CVE-2024-47226.1A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affectsCVE-2024-472217.5CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.
CVE-2024-47208: Critical severity, CVSS 9.8 | Vulnix