{"id":"CVE-2024-38856","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-38856","generatedAt":"2026-10-31T09:13:55.006Z","title":"Apache OFBiz Incorrect Authorization Vulnerability","description":"Incorrect Authorization vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: through 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\n\nUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).","published":"2024-08-05T09:15:57.000Z","lastModified":"2026-06-17T07:41:08.000Z","status":"Analyzed","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-863"],"affected":["apache/ofbiz"],"epss":{"score":0.99427,"percentile":0.99942,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2024-08-27","dueDate":"2024-09-17","knownRansomwareCampaignUse":"Unknown","notes":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\nThis vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w; https://nvd.nist.gov/vuln/detail/CVE-2024-38856"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 17 September 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://issues.apache.org/jira/browse/OFBIZ-13128","tags":["Issue Tracking"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w","tags":["Mailing List","Vendor Advisory"],"source":"security@apache.org"},{"url":"https://ofbiz.apache.org/download.html","tags":["Product"],"source":"security@apache.org"},{"url":"https://ofbiz.apache.org/security.html","tags":["Patch"],"source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2024/08/04/1","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856","tags":["Third Party Advisory","US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-38856","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}