PT-2024-5362 · Apache · Apache Ofbiz

4Ra1N + 16 · Published 2024-08-04 · Updated 2025-08-23 · CVE-2024-38856

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions through 18.12.14

Description This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

Recommendations Apache OFBiz versions through 18.12.14: Upgrade to version 18.12.15 to resolve the issue. As a temporary workaround, consider restricting access to unauthenticated endpoints to minimize the risk of exploitation.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-05995

CVE-2024-38856

ZDI-24-1099

Affected Products

Apache Ofbiz

References · 118

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb · Exploit
• 🔥 https://github.com/securelayer7/CVE-2024-38856_Scanner · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2024-32113 · Exploit
• 🔥 https://github.com/0x20c/CVE-2024-38856-EXP · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-38856-poc · Exploit
• 🔥 https://github.com/ThatNotEasy/CVE-2024-38856 · Exploit
• 🔥 https://github.com/AlissonFaoli/Apache-OFBiz-Exploit · Exploit
• https://bdu.fstec.ru/vul/2024-05995 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38856 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-1099 · Security Note
• https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38856 · Vendor Advisory
• https://github.com/apache/ofbiz-framework/commit/9b20a93c2487cca47392e6489472495ab4719447 · Note
• https://twitter.com/opsmatters_uk/status/1823875148342001877 · Twitter Post
• https://twitter.com/Loginsoft_Inc/status/1828736506720039295 · Twitter Post