Apache OFBiz Logo

Apache OFBiz Security

Security Model

The Security Model describes the assumptions and guarantees the project makes with respect to security.
A detailed description of the Apache OFBiz Security Model is available at SECURITY.md.

Security Policy

The Security Policy defines the rules and procedures for reporting, handling, and disclosing security vulnerabilities.
The Apache Software Foundation (ASF) Security Policy, established by the ASF Security Team, applies to all ASF projects, including OFBiz.
For detailed information, please refer to the ASF Security Team webpage.

Reporting a Security Vulnerability

Security vulnerabilities should be reported privately to the Apache OFBiz Security Team following ASF security reporting guidelines at: security@ofbiz.apache.org.
Before submitting a report, please carefully review the OFBiz Security Model to ensure the issue falls within the project's defined security scope and assumptions.
Please submit each vulnerability report in a separate email to facilitate efficient tracking and resolution.
Please do not report security issues through public issue trackers or mailing lists.
The OFBiz Security Team will acknowledge receipt of the report and work with the reporter to investigate and address the issue.

Documentation on Configuring and Deploying a Secure Apache OFBiz Instance

The OFBiz wiki provides guidance on how to securely configure and deploy Apache OFBiz instances.
The following resources are particularly relevant:
  • OFBiz Security Permissions the page and its subpages describe the OFBiz permissions system and how to use it to secure your OFBiz instance.
  • Keeping OFBiz secure. the page and its subpages describe how to keep your OFBiz instance secure from known exploits and to secure your OFBiz instance from a more general perspective.

List of Known Vulnerabilities

The following is a list of known security vulnerabilities in Apache OFBiz.