Apache OFBiz Forced Browsing Vulnerability

A forced browsing vulnerability has been identified in Apache OFBiz versions prior to 18.12.16. This vulnerability allows unauthorized access to rendered views by exploiting confused controller-view authorization logic. Users are advised to upgrade to version 18.12.16, which addresses this issue by introducing a new permission check for view-maps and changing the default settings for request-maps.

Impact

Exploitation of this vulnerability could lead to unauthorized access to views that should be restricted, allowing users to view or interact with content or functionality they are not permitted to access.

Remediation

Users can upgrade to Apache OFBiz version 18.12.16 to address this vulnerability. Instructions for downloading this version are available on the Apache OFBiz download page.