Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/ofbiz-framework

              trunk @ da5c51f
            

491

Fixes

CVEs

CRITICAL

Peak severity

17.9%

Coverage

Highlights

Auth Bypass: 154 prior fixes. Scrutinize any change in this area.

framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java: most-fixed (37 issues). Treat as high-risk during review.

384 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Dominant vulnerability class; many fixes address missing permission checks on services, request-maps, and UI, often with incorrect action names (e.g., CREATE vs UPDATE) or fail-open logic.

Webshell/File Upload RCE: Repeatedly patched for webshell token bypasses, dangerous extensions, image metadata injection, and fail-open validation; CVE-2021-37608 fixed multiple times.

Insecure Deserialization: Multiple whitelist/denylist bypasses (java.rmi, generics markup, primitive arrays) leading to RCE; also XML-RPC and XStream vectors.