.. / CVE-2023-50968

• SSRF
• Nuclei
• Web

Exploit for Apache OFBiz < 18.12.11 - Server Side Request Forgery (CVE-2023-50968)

Description:

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.

Nuclei Template

View the template here CVE-2023-50968.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-50968.yaml

References: