Advisory Details

February 21st, 2024

Apache OFBiz createRegister Error Message Information Disclosure Vulnerability

CVE ID	CVE-2024-23946
CVSS SCORE	5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AFFECTED VENDORS	Apache
AFFECTED PRODUCTS	OFBiz
VULNERABILITY DETAILS	This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apache OFBiz. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createRegister method. The issue results from outputting an error message that includes sensitive information. An attacker can leverage this vulnerability to disclose the names of internal paths used by the system.
ADDITIONAL DETAILS	Apache has issued an update to correct this vulnerability. More details can be found at: https://issues.apache.org/jira/browse/OFBIZ-12884
DISCLOSURE TIMELINE	2024-01-17 - Vulnerability reported to vendor 2024-02-21 - Coordinated public release of advisory 2024-07-01 - Advisory Updated
CREDIT	Arun Shaji of Trend Micro DSLabs

BACK TO ADVISORIES