This issue was initially reported to the security team by Alvaro Munoz <email@example.com> from the GitHub Security Lab team <firstname.lastname@example.org>. It was also reported 15 days later by Kai Zhao <email@example.com>.
It's a well known post-auth vulnerability so no CVE was created. It relies on Freemarker freemarker.template.utility.Execute class and new() built-in.
Since Freemarker 2.3.17 a known solution to these issues is to register a TemplateClassResolver in Freemarker configuration in order to limit which TemplateModels can be instantiated in the templates. The predefined resolver SAFER_RESOLVER doesn't allow to instantiate the Execute class. So the solution is to add the line
In  a concern about the Freemarker api buit-in is mentioned. Actually this is not a concern by default in Freemarker and OFBiz
The api_builtin_enabled configuration setting must be set to true. Its default is false (at least as of 2.3.22) for not lowering the security of existing applications.