CVE-2023-50968: Apache OFBiz unauthenticated file read and SSRF via URI call

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable information disclosure and SSRF with a CVSS of 7.5 and very high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

Apache OFBiz allows an unauthenticated user to invoke a URI that reads arbitrary file properties and can also be used to perform server-side request forgery. Both issues stem from missing authorization checks on the URI call, so an exposed OFBiz instance leaks local file data and can be used to reach internal services.

Impact

An attacker gains read access to file properties on the server and can make the server issue requests to internal or external systems, enabling information disclosure and use of OFBiz as an SSRF pivot.

Attack surface

Reachable over the network through a crafted URI call with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.63373 (99.17th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Upgrade Apache OFBiz to 18.12.11 or later, which the vendor states fixes the issue.
• Restrict network access to OFBiz management and URI endpoints to trusted hosts only.
• Apply authorization checks or a reverse-proxy rule that blocks unauthenticated access to the affected URI pattern.
• Monitor and egress-filter outbound traffic from OFBiz servers to limit SSRF reach into internal networks.

Detection

• Review OFBiz access logs for unauthenticated requests to unusual or unexpected URI paths.
• Alert on outbound connections from OFBiz hosts to internal RFC1918 addresses or unexpected external destinations.
• Watch for repeated file-property read patterns or error responses that indicate probing of the vulnerable URI.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.