Live › vulnerability › CVE-2024-38856
Go to dashboardApache OFBiz, an open-source ERP suite, has an incorrect authorization flaw that lets an unauthenticated remote attacker send a Groovy payload. That payload runs as the OFBiz process, which means remote code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache ofbiz | vendor | < 18.12.15 | 18.12.15 |
| Apache OFBiz | vendor | – | – |
Unknown from the sources.
Upgrade Apache OFBiz to a fixed release per the Apache advisory, or apply the vendor mitigation; the sources do not name the exact fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: through 18.12.14.
Users are recommended to upgrade to version 18.12.15, which fixes the issue.
Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
This page as .md · .json · in your agent: get_signal("CVE-2024-38856")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.