PT-2024-5989 · Apache · Apache Ofbiz

Hasib Vhora + 4 · Published 2024-08-14 · Updated 2026-03-31 · CVE-2024-45195

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.16

Description The issue is a Direct Request ('Forced Browsing') vulnerability in Apache OFBiz, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers. This vulnerability has been actively exploited by hackers, with over 25,000 requests targeting 4,000 unique sites detected by Imperva. The vulnerability allows for unauthenticated remote code execution.

Recommendations Apache OFBiz versions prior to 18.12.16: Upgrade to version 18.12.16 to prevent attacks. As a temporary workaround, consider restricting access to vulnerable modules or functions until a patch is applied.

Fix

RCE

Weakness Enumeration

CWE-425

Related Identifiers

BDU:2024-06798

CVE-2024-45195

Affected Products

Apache Ofbiz

References · 126

• https://osv.dev/vulnerability/CVE-2024-45195 · Vendor Advisory
• https://issues.apache.org/jira/browse/OFBIZ-13130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45195 · Security Note
• https://bdu.fstec.ru/vul/2024-06798 · Security Note
• https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy · Vendor Advisory
• https://twitter.com/XynikIT/status/1832031653155205414 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/03/6 · Note
• https://twitter.com/Orenda_Security/status/1833712634358591503 · Twitter Post
• https://twitter.com/buaqbot/status/1833524721591239111 · Twitter Post
• https://twitter.com/Loginsoft_Inc/status/1887396463543787900 · Twitter Post
• https://twitter.com/Sekurenet/status/1887012357836300474 · Twitter Post
• https://twitter.com/Dhananj82759483/status/1831923469766087010 · Twitter Post
• https://twitter.com/cipherstorm/status/1834179926414819632 · Twitter Post
• https://twitter.com/patchnow24x7/status/1831926779608756525 · Twitter Post
• https://twitter.com/transilienceai/status/1889500859232559392 · Twitter Post