Every CVE Search/ Get API key

CVE-2024-38856

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

9.8 CriticalIn KEVPublic exploit

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.4%Up 99.4 points since Aug 6, 2024
90%50%10%1%

What each source reports

NVD Score used 9.8

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Record
CVE-2024-38856
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
CVE List 8.1

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Record
CVE-2024-38856
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2024-37643 8.1

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Record
EUVD-2024-37643
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gp2r-34c8-48xq 8.1

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through...

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Record
GHSA-gp2r-34c8-48xq
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
CISA KEV No score

Apache OFBiz Incorrect Authorization Vulnerability

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

Record
CVE-2024-38856
Weakness
CWE-863
Updated
2026-11-02
OSV 8.1

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Record
CVE-2024-38856
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache OFBiz forgotPassword/ProgramExport RCE2024-05-30
PoC in GitHubsecurelayer7/CVE-2024-38856_Scanner2024-08-08
PoC in GitHubAp0dexMe0/CVE-2024-388562024-08-10
PoC in GitHubGraySignal/CVE-2024-38856-ApacheOfBiz2024-08-18
PoC in GitHub0x20c/CVE-2024-38856-EXP2024-08-22
PoC in GitHubemanueldosreis/CVE-2024-388562024-08-27
PoC in GitHubBBD-YZZ/CVE-2024-38856-RCE2024-08-28
PoC in GitHubFakesiteSecurity/CVE-2024-38856_Scen2025-01-02
PoC in GitHubAlissonFaoli/Apache-OFBiz-Exploit2025-02-11
PoC in GitHubHex00-0x4/CVE-2024-38856-Apache-OFBiz2025-10-10
NucleiApache OFBiz - Improper Authorization & Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38856 is a critical vulnerability (CVSS 9.8) in Apache Ofbiz, published August 5, 2024. CISA lists it as known to be exploited, since August 27, 2024. EUVD reports exploitation since August 27, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.4%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open