Apache OFBiz Logo

Security

Security Vulnerabilities

Please see the ASF Security Team webpage for further information about reporting a security vulnerability as well as their contact information.

We strongly encourage OfBiz users to report security problems affecting OFBiz to the private security mailing lists (either security@ofbiz.apache.org or security@apache.org), before disclosing them in a public forum. Please don't pack several vulnerabilities in the same report, send them one by one, thanks in advance.

Note that we no longer create CVEs for post-authN attacks done using demo credentials, notably using the admin user. Rather create bugs reports in our issue tracker (Jira) for that. Please don't create Jira issues for unauth (aka pre-authN) reports, thanks in advance.

One of the reason we no longer create CVEs for post-authN attacks done using demo credentials is because we highly suggest to OFBiz users to not use credentials demo in production and we expect OFBiz users to do so. We also warn our users on the "Keeping OFBiz secure wiki page". And we finally reject pre-authN vulnerabilities because we have a solid CSRF defense.

To clarify the vocabulary used above here are 2 links:

List of Known Vulnerabilities