Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Apache OFBiz releases up to and including 18.12.14 are affected. The fix is in 18.12.15.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 18.12.15
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache OFBiz, an open-source enterprise resource planning framework, is affected. An attacker without logging in could potentially trigger execution of screen rendering code on servers where certain conditions are met, such as screens that do not enforce their own permission checks.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Software Foundation Apache OFBiz
through 18.12.14
References 4
ofbiz.apache.org
lists.apache.org
issues.apache.org
Questions about CVE-2024-38856
What should I do about it?
Upgrade Apache OFBiz to 18.12.15, which contains the fix (commit 31d8d7). The sources list no workaround.Source: ofbiz.apache.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-08-27, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
Why do the sources disagree?
The description says the endpoint is unauthenticated, but the CVSS vector scores the flaw as requiring low privileges (PR:L). The sources do not reconcile these two statements.Source: ofbiz.apache.org