{"id":"CVE-2024-38856","published":"2024-08-05T09:15:56Z","modified":"2026-06-17T07:41:08Z","title":"Apache OFBiz Incorrect Authorization Vulnerability","vendor":"Apache","product":"OFBiz","tier":"core","eol":null,"description":{"text":"Incorrect Authorization vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: through 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\n\nUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).","provenance":"source","from":"NVD"},"summary":{"text":"An incorrect authorization flaw in Apache OFBiz, affecting versions through 18.12.14, allows unauthenticated endpoints to execute screen rendering code. Exploitation requires that certain preconditions are met, such as screen definitions that do not explicitly check user permissions and instead rely on the configuration of their endpoints.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:46Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99427,"percentile":0.99942,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-08-27","dueDate":"2024-09-17","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w; https://nvd.nist.gov/vuln/detail/CVE-2024-38856","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-08-19","exploitedFirstSeen":"2024-08-19","ransomware":false,"evidence":[{"url":"https://www.fortiguard.com/outbreak-alert/apache-ofbiz-rce","date":"2024-08-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-08-27"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://cyble.com/blog/cyble-sensors-detect-exploit-attempts-on-ivanti-avtech-ip-cameras/","date":"2025-03-19"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-38856","date":"2025-06-07"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-09&host_type=src&vulnerability=cve-2024-38856","date":"2026-09-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-10&host_type=src&vulnerability=cve-2024-38856","date":"2026-09-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-11&host_type=src&vulnerability=cve-2024-38856","date":"2026-09-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-12&host_type=src&vulnerability=cve-2024-38856","date":"2026-09-12"}],"evidenceTotal":38,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://issues.apache.org/jira/browse/OFBIZ-13128","tags":["Issue Tracking"]},{"url":"https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w","tags":["Mailing List","Vendor Advisory"]},{"url":"https://ofbiz.apache.org/download.html","tags":["Product"]},{"url":"https://ofbiz.apache.org/security.html","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/04/1","tags":["Mailing List"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote endpoint exploitation of public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Unauthenticated endpoints could allow execution of screen rendering code of screens","start":186,"end":269}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: screen rendering code execution on server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow execution of screen rendering code of screens","start":212,"end":269}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-37643","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37643","exploited":true,"exploitedSince":"2024-08-27","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":9,"skipped":0,"earliest":"2024-08-08","earliestUrl":"https://github.com/securelayer7/CVE-2024-38856_Scanner","repos":[{"name":"securelayer7/CVE-2024-38856_Scanner","url":"https://github.com/securelayer7/CVE-2024-38856_Scanner","stars":49,"created":"2024-08-08"},{"name":"0x20c/CVE-2024-38856-EXP","url":"https://github.com/0x20c/CVE-2024-38856-EXP","stars":9,"created":"2024-08-22"},{"name":"BBD-YZZ/CVE-2024-38856-RCE","url":"https://github.com/BBD-YZZ/CVE-2024-38856-RCE","stars":3,"created":"2024-08-28"},{"name":"Hex00-0x4/CVE-2024-38856-Apache-OFBiz","url":"https://github.com/Hex00-0x4/CVE-2024-38856-Apache-OFBiz","stars":3,"created":"2025-10-10"},{"name":"Ap0dexMe0/CVE-2024-38856","url":"https://github.com/Ap0dexMe0/CVE-2024-38856","stars":2,"created":"2024-08-10"}]},"metasploit":[{"name":"Apache OFBiz forgotPassword/ProgramExport RCE","module":"exploit/multi/http/apache_ofbiz_forgot_password_directory_traversal","type":"exploit","disclosureDate":"2024-05-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb"}],"nuclei":[{"id":"CVE-2024-38856","name":"Apache OFBiz - Improper Authorization & Remote Code Execution","severity":"critical","path":"http/cves/2024/CVE-2024-38856.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38856.yaml"}],"first":{"date":"2024-05-30","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-05-30","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-08-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb","provenance":"source"},{"date":"2024-08-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38856","provenance":"source"},{"date":"2024-08-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/outbreak-alert/apache-ofbiz-rce","provenance":"source"},{"date":"2024-08-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-08-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37643","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":22},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 803 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"9 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}