KEVIntel
Back to KEVs
8.1
CVSS
High

CVE-2024-38856

PUBLISHED

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Exploited in the wild PoC available Remote Low complexity No user interaction
Vendor
Apache Software Foundation
Product
Apache OFBiz
Published
Aug 05, 2024
EPSS
—

Description

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

apache cisa nuclei_scanner metasploit nessus_scanner

CVSS scores

CVSS v3.1 8.1 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitation status

Exploited in the wild

Recorded 2024-08-27 00:00:00 UTC · Source

Proof of concept available

Recorded 2024-08-08 02:40:56 UTC · Source

SSVC decision points

Exploitation
active
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Aug 27, 2024

Scanner integrations

Scanner Reference Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb Apr 28, 2025
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38856.yaml Apr 25, 2025
Nessus https://www.tenable.com/plugins/nessus/206393 Aug 30, 2024

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

apache_ofbiz_forgot_password_directory_traversal

metasploit · Created Unknown

Metasploit module for CVE-2024-38856

BBD-YZZ/CVE-2024-38856-RCE

github · Created 2024-08-28 03:17:22 UTC · 3 stars

Apache OFBiz CVE-2024-38856

0x20c/CVE-2024-38856-EXP

github · Created 2024-08-22 04:05:02 UTC · 9 stars

CVE-2024-38856 Exploit

ThatNotEasy/CVE-2024-38856

github · Created 2024-08-10 03:05:34 UTC · 2 stars

Perform With Massive Apache OFBiz Zero-Day Scanner & RCE

securelayer7/CVE-2024-38856_Scanner

github · Created 2024-08-08 02:40:56 UTC · 43 stars

Apache OFBiz RCE Scanner & Exploit (CVE-2024-38856)

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Added to KEVIntel

  • Detected by Nessus

  • Detected by Nuclei

  • Detected by Metasploit