CVE-2026-83542

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-83542", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-31T17:54:52.913Z", "datePublished": "2026-11-05T13:59:22.695Z", "dateUpdated": "2026-11-12T10:41:35.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-12T10:41:35.991Z"}, "title": "Apache OFBiz: Unauthenticated RCE via login-page widget injection", "problemTypes": [{"descriptions": [{"description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "lang": "en", "cweId": "CWE-94", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache OFBiz", "versions": [{"status": "affected", "version": "0", "lessThan": "24.09.08", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:\n\n-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.\n\n-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.\n\n-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response \u2014 it is not limited to the login-failure rendering path used in the original report.\n\n\n\nThe described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.\n\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:<br><br>-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.<br><br>-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.<br><br>-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response \u2014 it is not limited to the login-failure rendering path used in the original report.<br><div><br></div><div>The described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.</div><div><br></div>Users are recommended to upgrade to version 24.09.08, which fixes this issue."}]}], "references": [{"url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz", "tags": ["vendor-advisory"]}, {"url": "https://app.opencve.io/cve/CVE-2026-68524"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Jonah Burgess (CryptoCat)", "type": "reporter"}, {"lang": "en", "value": "Krishna Uprit", "type": "remediation developer"}, {"lang": "en", "value": "David Crees, Abstract Shield", "type": "reporter"}, {"lang": "en", "value": "Naoya Takahashi (nakko)", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T04:56:29.596160Z", "id": "CVE-2026-83542", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T11:39:30.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-83542", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T15:46:04.234961Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T15:43:57.799Z"}}], "cna": {"title": "Apache OFBiz: Unauthenticated RCE via login-page widget injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Jonah Burgess (CryptoCat)"}, {"lang": "en", "type": "remediation developer", "value": "Krishna Uprit"}, {"lang": "en", "type": "reporter", "value": "David Crees, Abstract Shield"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache OFBiz", "versions": [{"status": "affected", "version": "0", "lessThan": "24.09.08", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:\n\n-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.\n\n-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.\n\n-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response \u2014 it is not limited to the login-failure rendering path used in the original report.\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:<br><br>-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.<br><br>-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.<br><br>-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response \u2014 it is not limited to the login-failure rendering path used in the original report.<br><br>Users are recommended to upgrade to version 24.09.08, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-05T13:59:22.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-83542", "state": "PUBLISHED", "dateUpdated": "2026-11-06T11:39:30.788Z", "dateReserved": "2026-08-31T17:54:52.913Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-11-05T13:59:22.695Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache OFBiz", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "24.09.08", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E2A8021-ECC9-4625-87A7-E8F4DE835DB6", "versionEndExcluding": "24.09.08", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:\n\n-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.\n\n-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.\n\n-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response \u2014 it is not limited to the login-failure rendering path used in the original report.\n\n\n\nThe described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.\n\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue."}], "id": "CVE-2026-83542", "lastModified": "2026-11-12T11:17:13.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-83542", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T04:56:29.596160Z", "version": "2.0.3"}}]}, "published": "2026-11-05T14:17:06.820", "references": [{"source": "security@apache.org", "url": "https://app.opencve.io/cve/CVE-2026-68524"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,24.09.08)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache OFBiz", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "ofbiz", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,24.09.08)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache OFBiz", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_ofbiz", "vendor": "apache_software_foundation"}], "created": "2026-11-05T15:45:17.608243+00:00", "updated": "2026-11-06T15:00:08.017504+00:00", "vendors": ["apache", "apache$PRODUCT$ofbiz", "apache_software_foundation", "apache_software_foundation$PRODUCT$apache_ofbiz"]}