CVE-2023-50968

7.5 highEPSS 63%

High (7.5) in apache ofbiz. EPSS 63% chance of exploitation in the next 30 days.

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 63% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-918, CWE-200
Published: 2023-12-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:ofbiz

References

http://www.openwall.com/lists/oss-security/2023/12/26/2
https://issues.apache.org/jira/browse/OFBIZ-12875
https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/release-notes-18.12.11.html

Check your stack JSON