UpHeron
All vulnerabilities

Servers and applications

CVE-2024-38856

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 27 Aug 2024.

Severity
Critical 9.8
Published
5 Aug 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
18.12.15
Sources
NVD

Affected software

SoftwareAffected versions
Apache OFBizServers and applications · cpe:a:apache:ofbiz
  • Every version before 18.12.15

Known exploited

CISA name
Apache OFBiz Incorrect Authorization Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
17 Sept 2024
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-38856
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-38856