CVE-2024-38856

Apache OFBiz: Incorrect Authorization

As of , CVE-2024-38856 in Apache OFBiz is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 27 August 2024
US federal deadline
17 September 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.00 on 27 August 2024EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: lists.apache.orgLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA's required action

  • lists.apache.orgThis vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check…

What the flaw is

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

CISA's description

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

The CVE record's description, from apache

CVE published
5 August 2024
Assigned by
apache
CVSS
8.1 High (CVSS 3.1, from CISA-ADP)
CWE-863
Incorrect Authorization
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Apache OFBiz forgotPassword/ProgramExport RCEexploit module, rank excellent

OFBiz: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2024-32113Path TraversalApache OFBizPatch this weekMetasploit module; EPSS 0.990.99
CVE-2024-45195Forced BrowsingApache OFBizPatch this weekEPSS 0.990.99

Read further