2020/08/10 the OFBiz security team received a security report by Harshit Shukla <firstname.lastname@example.org>, roughly it was (quoting part of it to simplify):
I have identified a Remote Code Execution (RCE) Vulnerability. The reason behind this RCE is lack of file extension check at catalog/control/UploadCategoryImage?productCategoryId=CATALOG1_BEST_SELL&pload_file_type=category
Using this post-auth RCE in OFBiz demos, Harshit was able to get some AWS credentials by uploading a webshell (based on ). By security, it was then decided by the Infra and OFBiz security teams to shut down the demos.
After I decided we needed to secure all our uploads and not only checking extensions, I began to work on the vulnerablity. During this work I discovered, according to  and , that these AWS credentials are so far considered harmless.
This post-auth RCE relies on the demo data. In our documentation, we warn our users to not use the demo data. Notably because they allow to sign in as an admin!
After discussing these elements with Mark J Cox (VP of ASF security team) we in common decided that no CVE was necessary.