Threats tagged 'ghsa-j8vh-w84j-pvrg'

An XML External Entity (XXE) injection vulnerability exists in the ContentWorker component of Apache OFBiz 24.09 before 24.09.08 on all platforms. A remote authenticated attacker with content-author permissions can exploit this flaw by submitting crafted XML content containing external entity declarations. This leads to arbitrary file reading on the server and potential server-side request forgery during content rendering. The issue is fixed in version 24.09.08.