title: Apache OFBiz: Arbitrary file properties reading and SSRF attack
description: Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.
The same uri can be operated to realize a SSRF attack also  without  authorizations.
Users are recommended to upgrade to version 18.12.11, which fixes this issue.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: Apache OFBiz
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 18.12.10, status: affected, version: 0, versionType: custom
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]