CVE-2024-47208

CVE-2024-47208: Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Vendor Apache Software Foundation

Product Apache OFBiz

Weakness CWE-918 · SSRF

Published November 18, 2024

Last update November 19, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

Key dates

02Disclosure timeline

November 18, 2024 CVE published

November 19, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-47208 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html AskarLabs — CWE-918 write-up Server-Side Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-57413 WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-39695 WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-39645 WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-2948 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' CVE-2026-57372 WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability