.webp)
A critical vulnerability has been discovered in Apache OFBiz resulting from an incomplete fix to CVE-2023-49070. Discovered by SonicWall, this CVE is classified as CVE-2023-51467 and is being tracked as an Authentication Bypass vulnerability. According to NVD, this vulnerability allows for attackers to bypass authentication to achieve a simple Server-Side Request Forgery. This vulnerability can be considered a zero-day as there is proof-of-concept code available from SonicWall’s investigation.
SonicWall describes Apache OFBiz as an open-source Enterprise Resource Planning system. It is a part of the software supply chain and has a wide install base in prominent software such as JIRA.
Apache OFbiz up to version 18.12.11.
Reviewing your software inventory for any installations of Apache OFBiz as well as reviewing if any software used by your organization uses OFBiz and apply vendor patches where they apply.
If you use Apache OFBiz natively patch it to version 18.12.11 or later, if an application/software that your organization uses utilizes OFBiz such as Jira, follow their patching cycle for any updates.
This vulnerability if exploited could result in many supply chain libraries being compromised, sensitive information being exposed, and arbitrary code execution being performed. Monetary and reputational loss will follow as a result of exploitation.
Patch: Patching this vulnerability as soon as possible according to vendor guidelines is recommended.
Stay informed: This vulnerability impacts a large number of supply chain libraries, review your software inventory and stay up to date on any other vendor updates regarding this vulnerability. IE: Jira
https://nvd.nist.gov/vuln/detail/CVE-2023-51467
https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/
https://issues.apache.org/jira/browse/OFBIZ-12873
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
