Actively exploited · Published Aug 5, 2024 · Assigned by apache
CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
High 8.1 Exploited
In plain English
A high-severity incorrect authorization in Apache OFBiz from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on August 27, 2024). The chance it is exploited in the next 30 days is estimated at 99.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 17, 2024.
Official description
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 – through 18.12.14 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://ofbiz.apache.org/download.html product, mitigation
- https://ofbiz.apache.org/security.html related
- https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w vendor-advisory
- https://issues.apache.org/jira/browse/OFBIZ-13128 issue-tracking
- http://www.openwall.com/lists/oss-security/2024/08/04/1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856 government-resource