Summary
A critical vulnerability has been discovered in Apache OFBiz resulting from an incomplete fix to CVE-2023-49070. Discovered by SonicWall, this CVE is classified as CVE-2023-51467 and is being tracked as an Authentication Bypass vulnerability. According to NVD, this vulnerability allows for attackers to bypass authentication to achieve a simple Server-Side Request Forgery. This vulnerability can be considered a zero-day as there is proof-of-concept code available from SonicWall’s investigation.
Impact Assessment
SonicWall describes Apache OFBiz as an open-source Enterprise Resource Planning system. It is a part of the software supply chain and has a wide install base in prominent software such as JIRA.
Affected Software:
Apache OFbiz up to version 18.12.11.
What it means for you
Reviewing your software inventory for any installations of Apache OFBiz as well as reviewing if any software used by your organization uses OFBiz and apply vendor patches where they apply.
Remediation
If you use Apache OFBiz natively patch it to version 18.12.11 or later, if an application/software that your organization uses utilizes OFBiz such as Jira, follow their patching cycle for any updates.
Business Implications
This vulnerability if exploited could result in many supply chain libraries being compromised, sensitive information being exposed, and arbitrary code execution being performed. Monetary and reputational loss will follow as a result of exploitation.
Access Point Technology Recommends
Patch: Patching this vulnerability as soon as possible according to vendor guidelines is recommended.
Stay informed: This vulnerability impacts a large number of supply chain libraries, review your software inventory and stay up to date on any other vendor updates regarding this vulnerability. IE: Jira
Associated Bulletins
https://nvd.nist.gov/vuln/detail/CVE-2023-51467
https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/
https://issues.apache.org/jira/browse/OFBIZ-12873
.webp)
.png)
