CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- Record
CVE-2024-45195- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-425
- Updated
- 2026-11-02
CVE List
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- Record
CVE-2024-45195- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-425
- Updated
- 2026-11-02
EUVDEUVD-2024-41762
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- Record
EUVD-2024-41762- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hrmf-4pvg-rf3x
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache...
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- Record
GHSA-hrmf-4pvg-rf3x- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-425
- Updated
- 2026-11-02
CISA KEV No score
Apache OFBiz Forced Browsing Vulnerability
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
- Record
CVE-2024-45195- Weakness
- CWE-425
- Updated
- 2026-11-02
OSV
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- Record
CVE-2024-45195- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-425
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | wyyazjjl/CVE-2024-45195 | 2025-07-23 |
| Nuclei | Apache OFBiz - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45195 is a high vulnerability (CVSS 7.5) in Apache Ofbiz, published September 4, 2024. CISA lists it as known to be exploited, since February 4, 2025. EUVD reports exploitation since February 4, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.
References
ofbiz.apache.org/download.html
issues.apache.org/jira/browse/OFBIZ-13130
lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy
openwall.com/lists/oss-security/2024/09/03/6
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195
nvd.nist.gov/vuln/detail/CVE-2024-45195
github.com/advisories/GHSA-hrmf-4pvg-rf3x