Threats tagged 'ghsa-rrr7-7j73-7fhw'

Apache OFBiz 24.09 versions prior to 24.09.08 contain a missing authorization vulnerability in ProductEvents. This flaw allows a remote authenticated user with only catalog view permission to create, modify, or delete product-related data by invoking certain catalog quick-admin events. The issue arises because the servlet authorizes requests based on view-level permissions, while the underlying event methods perform write operations without verifying update/create permissions. Upgrading to version 24.09.08 resolves this vulnerability.