Actively exploited · Published Sep 4, 2024 · Assigned by apache
CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Apache OFBiz from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on February 4, 2025). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 25, 2025.
Official description
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 – before 18.12.16 |
Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://ofbiz.apache.org/download.html mitigation, product, release-notes
- https://ofbiz.apache.org/security.html patch
- https://issues.apache.org/jira/browse/OFBIZ-13130 issue-tracking
- https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy vendor-advisory
- http://www.openwall.com/lists/oss-security/2024/09/03/6
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195 government-resource