Description
Apache OFBiz 存在鉴权绕过漏洞，该漏洞是由于loadJWT接口对用户的请求验证不当所导致的。
Apache OFBiz CVE-2024-25065 鉴权绕过漏洞 2
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://mdr.skyeye.qianxin.com/forum/share/3117
http://cn-sec.com/archives/2554883.html
https://avd.aliyun.com/detail?id=AVD-2024-25065
https://nvd.nist.gov/vuln/detail/cve-2024-25065
https://github.com/advisories/GHSA-3vg3-g88w-vjgf
https://blog.securelayer7.net/security-bypass-in-apache-ofbiz/
https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc
https://issues.apache.org/jira/browse/OFBIZ-12887
https://y4tacker.github.io/2024/06/23/year/2024/8/Apache-OFBiz-Authentication-Bypass-CVE-2024-38856/