Description
Apache OFBiz存在服务器端请求伪造漏洞。此漏洞是由于对requiredLabel参数缺乏校验导致的。
Apache OFBiz CVE-2023-50968 服务端请求伪造漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/detail?id=AVD-2023-50968
https://zhi.oscs1024.com/40174.html
https://www.ddpoc.com/DVB-2024-6015.html
https://www.imeic.edu.cn/xxzx/info/1150/3362.htm
https://security.zone.ci/aliyun/ali_highrisk/305808.html
https://cve.imfht.com/poc_detail/03884ff1a1660b15e528f629a2a5da51be139346
https://cn-sec.com/archives/tag/%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%AB%AF%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0/page/4
https://xxzx.sjzc.edu.cn/col/1718090449302/2024/05/07/1718094396432.html
https://cloud.tencent.com/developer/article/2381320
https://blog.csdn.net/softstars/article/details/2532327
https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q
https://issues.apache.org/jira/browse/OFBIZ-12875
https://ofbiz.apache.org/security.html
https://nvd.nist.gov/vuln/detail/cve-2023-50968