Apache OFBiz is vulnerable to a low‑privilege Server‑Side Request Forgery via its Content component. An attacker who can invoke the vulnerable operations can cause the server to initiate outbound HTTP requests to arbitrary URLs. This allows access to internal network resources, the collection of sensitive data, or the execution of unintended actions against internal services. The weakness is classified as CWE‑918.

The vulnerability exists in all Apache OFBiz releases before version 24.09.06. Users running any of these versions are exposed.

The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog. The CVSS score is 7.3, but because the flaw permits arbitrary server‑initiated requests from a low‑privilege context, the potential impact is significant and the risk of exploitation is high if the Content component is exposed to untrusted users. The likely attack vector is through authenticated or unauthenticated access to the affected endpoint, requiring only low privileges to trigger the request.