CVE Watch—

CVE-2024-38856

Apache OFBiz Incorrect Authorization Vulnerability

CVSS

—

Sem CVSS

EPSS

99.4%

p100

KEV

SIM

27 de ago. de 2024

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

99.4%EPSS · 30 dias99.4%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Apache / OFBiz

Vulnerabilidade

Apache OFBiz Incorrect Authorization Vulnerability

Adicionado ao KEV

27 de ago. de 2024

Corrigir até

17 de set. de 2024

Uso conhecido em ransomware

Não

Descrição resumida

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w; https://nvd.nist.gov/vuln/detail/CVE-2024-38856

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2024-32113—

100.0%

KEV—80Apache OFBiz Path Traversal Vulnerability—CVE-2024-45195—

100.0%

KEV—80Apache OFBiz Forced Browsing Vulnerability—