Apache OFBiz Code Injection Vulnerability Allowing Authenticated Groovy Code Execution

A code injection vulnerability has been identified in Apache OFBiz versions prior to 24.09.06. This issue arises from improper control over code generation, allowing for the execution of arbitrary Groovy code by authenticated users. The vulnerability is linked to inadequate neutralization of directives in dynamically evaluated code, creating an 'Eval Injection' scenario.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary Groovy code on the server, potentially leading to unauthorized actions or access within the application.

Remediation

Users are advised to upgrade to Apache OFBiz version 24.09.06 or later, which addresses this vulnerability.