Threats tagged 'ghsa-4h6p-jqmx-q688'

Apache OFBiz 24.09 versions prior to 24.09.08 contain a missing authorization vulnerability in the ProductSearchEvents component. This flaw allows a remote authenticated user with only catalog view permission to perform bulk modifications on product category and feature associations across arbitrary search results. The issue arises because the servlet authorizes requests based solely on view-level permissions, while underlying event methods execute bulk entity modifications without enforcing the necessary DELETE or CREATE permissions. Upgrading to version 24.09.08 addresses this vulnerability.