Threats tagged 'ghsa-f4wx-9w48-qfrr'

Apache OFBiz 24.09 versions prior to 24.09.08 contain an improper authorization vulnerability in the ContentWorker component. This flaw allows a remote unauthenticated attacker to invoke arbitrary OFBiz services with attacker-controlled parameters by exploiting the public showHelpPublic view. The vulnerability enables arbitrary file write, file deletion, and server-side request forgery due to lack of authentication, ownership checks, and parameter validation. Upgrading to version 24.09.08 addresses this issue.