CVE-2024-45195criticalunder attackCWE-425

CVE-2024-45195: critical vulnerability in Apache OFBiz

Apache OFBiz: Confused controller-view authorization logic (forced browsing)

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon322 days
Published on NVDSep 4
1st PoC+322d
CISA KEV+153d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2025-02-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Apache OFBiz has a vulnerability that allows attackers to bypass authorization checks and access restricted pages directly by crafting specific requests, even without proper permissions.

Technical detail

A forced browsing vulnerability in Apache OFBiz's controller-view authorization logic (CWE-425) allows unauthenticated or unprivileged attackers to directly request restricted resources by circumventing authorization controls. The vulnerability exists in versions prior to 18.12.16 and can be exploited through direct HTTP requests to protected endpoints, resulting in unauthorized access to sensitive functionality or data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache OFBiz
public PoCs found — 1
githubgithub.com/wyyazjjl/CVE-2024-45195★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache OFBiz

In the same product, most dangerous first.

CVE-2024-32113CRITICALApache OFBiz: Path traversal leading to RCEEPSS 99.9%KEVCVE-2024-38856HIGHApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeEPSS 99.4%KEVCVE-2021-26295—RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIEPSS 97.8%CVE-2023-51467—Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityEPSS 96.0%CVE-2023-49070—Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentEPSS 95.4%CVE-2024-45507HIGHApache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCEEPSS 93.2%
References
https://issues.apache.org/jira/browse/OFBIZ-13130https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wyhttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/security.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195http://www.openwall.com/lists/oss-security/2024/09/03/6