CVE-2024-38856: high-severity vulnerability in Apache OFBiz
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apache OFBiz allows unauthenticated users to execute screen rendering code on certain endpoints when permission checks are not explicitly enforced. This could let attackers bypass security controls and access or manipulate sensitive functionality without logging in.
CWE-863 (Incorrect Authorization) vulnerability in Apache OFBiz ≤18.12.14 permits unauthenticated access to screen rendering endpoints when screen definitions lack explicit permission validation. Attack vector requires network access to affected endpoints; exploitation occurs when screens rely solely on endpoint configuration for authorization rather than inline checks. Impact includes unauthorized code execution and potential data exposure or system compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.