InfoSecBulletin Cybersecurity for mankind
A new security flaw was found in Apache OfBiz, an open-source Enterprise Resource Planning (ERP) system. This flaw could be used to get around authentication protections.
The vulnerability, CVE-2023-51467, is found in the login feature and is caused by a partial fix for another serious vulnerability (CVE-2023-49070, CVSS score: 9.8) released this month.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
Daily Security Update Dated: 21.01.2025
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
CERT-UA alerts about “security audit” requests through AnyDesk
Oracle Critical Pre-Release update addressed 320 flaw
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS
Intel holds 22 employees from one Bangladeshi University
VPN Surge 1500% in USA after TikTok Shut Down
MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology
The Hacker News said its report “The security measures taken to patch CVE-2023-49070 left the root issue intact and therefore the authentication bypass was still present,” the SonicWall Capture Labs threat research team, which discovered the bug, said in a statement shared with The Hacker News.
CVE-2023-49070 is a security flaw that allows threat actors to take control of a server and steal sensitive data. It affects versions before 18.12.10 of Apache OFBiz due to a deprecated XML-RPC component.
SonicWall reported that CVE-2023-51467 allows an attacker to bypass protection measures and gain unauthorized access to internal resources. This can be done by exploiting empty or invalid USERNAME and PASSWORD parameters in an HTTP request, which triggers an authentication success message.
The attack is based on the parameter “requirePasswordChange” being set to “Y” in the URL. This allows authentication to be easily bypassed, regardless of the username and password entered.
Attackers can bypass authentication to perform a Server-Side Request Forgery (SSRF) using this vulnerability. This information is provided by the NIST National Vulnerability Database (NVD).
Apache OFBiz users should update to version 18.12.11 or later as soon as possible to stay safe from potential threats.
ALSO READ:
