[OFBIZ-12315] OFBiz Arbitrary file read vulnerability

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: Trunk
• Component/s: content
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 14/Sep/21 09:31
• Updated: 14/Sep/21 17:05
• Resolved: 14/Sep/21 13:25

Description

This post-auth security issue was reported to the security team by weinull orz <[e-mail]>

Hi,I found an arbitrary file read vulnerability in OFBiz,through this vulnerability, you can read system sensitive files and application configuration files (including database account passwords and other configurations)

URL:
content/control/updateLayoutSubContent
Content -> Template -> Create New

OFBIz version: 17.12.08

Vulnerability Repair:
Strictly restrict accessible files.

Orz Team of weinull