CVE-2024-48962

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-352 CWE-1336

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	< 18.12.17
apache	ofbiz	< 18.12.17

References

https://issues.apache.org/jira/browse/OFBIZ-13162Issue Tracking
https://lists.apache.org/thread/6sddh4pts90cp8ktshqb4xykdp6lb6q6Mailing List
https://ofbiz.apache.org/download.htmlProduct
https://ofbiz.apache.org/security.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2024/11/16/2Mailing List

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-489639.8The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be trigge CVE-2024-489648.8The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be tri CVE-2024-4896610.0The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access CVE-2024-4896710.0The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent for CVE-2024-48978.4parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python versi CVE-2024-489709.3The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flas CVE-2024-489719.3The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attack CVE-2024-489739.3The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over th CVE-2024-489749.3The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force CVE-2024-48989.8The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authori CVE-2024-489817.5An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet he CVE-2024-489827.5An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a by