Description
Apache OFBiz是一个用于构建企业级电子商务应用的平台。该漏洞由SSRF和信息泄露问题组成，攻击者可构造恶意请求绕过身份认证，获取敏感信息或发起服务端请求伪造攻击。由于该漏洞无需权限即可利用，可能导致关键业务数据泄露，建议企业立即升级至18.12.11或更高版本。
Apache OFBiz /partymgr/control/getJSONuiLabel 服务器端请求伪造漏洞（CVE-2023-50968）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-50968
https://issues.apache.org/jira/browse/OFBIZ-12875
https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q
https://cn-sec.com/archives/2429655.html
https://www.rapid7.com/db/vulnerabilities/apache-ofbiz-cve-2023-50968/
https://www.invicti.com/web-application-vulnerabilities/apache-ofbiz-ssrf-cve-2023-50968
https://www.openwall.com/lists/oss-security/2023/12/26/2
https://github.com/advisories/GHSA-gm45-8hgv-xg5f
https://ofbiz.apache.org/download.html
https://www.acunetix.com/vulnerabilities/web/apache-ofbiz-ssrf-cve-2023-50968/
https://my.f5.com/manage/s/article/K000149612