The vulnerability arises from improper input validation in Apache OFBiz UI Factory classes, allowing users to craft requests that the server will resolve and fetch. This SSRF flaw can be leveraged to access internal network resources or read arbitrary files through the application’s blind file access capability. The weakness is classified as CWE‑918, an injection of malicious URLs or hostnames into a server‑side resource request.

Apache Software Foundation’s OFBiz product is affected before the 24.09.06 release. All configurations of OFBiz running a version earlier than 24.09.06 that expose the relevant UI Factory endpoints are susceptible. Users should verify the installed version and ensure it is updated to 24.09.06 or later to eliminate the flaw.

The CVSS score is 7.5, and the EPSS score is < 1%. The flaw bears full remote impact on data confidentiality and integrity, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the SSRF vector by submitting a crafted parameter to the vulnerable UI Factory endpoint, triggering outbound calls that may reach privileged internal services or allow retrieval of local files.