Threats tagged 'ghsa-qrqw-hm9g-pvrw'

Apache OFBiz 24.09 versions prior to 24.09.08 contain an incorrect authorization vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to bypass authentication for protected views by appending the protected view path as a suffix to a public request path. The servlet incorrectly authorizes the request based on the public path component, enabling unauthorized access to protected content. The issue is fixed in version 24.09.08.