Threat Signal ReportApache OFBiz Authentication Bypass (CVE-2023-51467, CVE-2023-49070)
Description
| What is the vulnerability? | There is an authentication bypass vulnerability in Apache OFBiz tracked under CVE-2023-51467 and CVE-2023-49070. Successful exploitation would let an attacker circumvent authentication processes, enabling them to remotely execute arbitrary code and access sensitive information. Apache OFBiz is an open-source business application suite for Enterprise Resource Planning (ERP) which integrates and automates many of the business processes across industries. |
| What is the Vendor Solution? | Customers are advised to upgrade to Apache OFBiz version 18.12.11 to patch these vulnerabilities. For more information, please refer to the Apache Security Advisory. [ Link ] |
| What FortiGuard Coverage is available? |
FortiGuard Labs has an IPS signature "Apache.OFBiz.CVE-2023-49070.XMLRPC.Insecure.Deserialization" in place for CVE-2023-49070 and is investigating to create protection against exploitation of CVE-2023-51467.
FortiGuard Labs recommends companies to scan their environment, find vulnerable Apache OFBiz application, and upgrade as per vendor advisory and always follow best practices. |
✖
