Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz Üretici bülteni

Kayıt geçmişi

1. 5 Kas 2026 18:40CVSS puanı değişti: – → 4.3
2. 5 Kas 2026 17:05Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-82904Apache OFBiz'te parametre adına bağlı sınırsız çoklu form satır sayısı hatası
• 9,8 CVE-2026-82907Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
• 8,8 CVE-2026-82910Apache OFBiz: renderLink compiles link parameters as FreeMarker source
• 8,8 CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
• 7,1 CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any path
• 8,8 CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE