{"id":"CVE-2024-38856","kind":"vulnerability","aliases":["CVE-2024-38856"],"related":[],"title":"Incorrect Authorization vulnerability in Apache OFBiz","description":"Incorrect Authorization vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: through 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\n\nUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).","summary":"Apache OFBiz, an open-source ERP suite, has an incorrect authorization flaw that lets an unauthenticated remote attacker send a Groovy payload. That payload runs as the OFBiz process, which means remote code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-08-27T00:00:00+00:00","products":[{"name":"apache ofbiz","fixed":["18.12.15"],"affected":"< 18.12.15","ecosystem":"vendor"},{"name":"Apache OFBiz","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-ofbiz","exploited","java","package","self-hosted"],"not_affected_if":["not-running-ofbiz"],"how_to_check":null,"fix":"Upgrade Apache OFBiz to a fixed release per the Apache advisory, or apply the vendor mitigation; the sources do not name the exact fixed version.","status":"open","published_at":"2024-08-05T09:15:56+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:18+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:58:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache OFBiz to a fixed release per the Apache advisory, or apply the vendor mitigation; the sources do not name the exact fixed version.","reach":"internet","impact":"high","summary":"Apache OFBiz, an open-source ERP suite, has an incorrect authorization flaw that lets an unauthenticated remote attacker send a Groovy payload. That payload runs as the OFBiz process, which means remote code execution on the server.","category":"package","who_cares":["apache-ofbiz","self-hosted","java"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code as the OFBiz server process.","analyst_note":"Find the fixed OFBiz version and exact mitigation steps in the Apache OFBiz security advisory for CVE-2024-38856, and confirm which endpoints are affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-ofbiz"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000476,"input_tokens":2824,"output_tokens":387,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':8A,11A '-38856':9A,12A '18.12.14':76C '18.12.15':84C 'affect':72C 'allow':92C 'apach':5A,18B,26B,68C,73C 'apache':13A,15A 'apache-ofbiz':17B 'attack':44B 'author':2A,37B,65C 'check':114C 'code':59B,97C 'configur':123C 'could':91C 'cve':7A,10A 'definit':110C 'endpoint':90C,126C 'erp':32B 'execut':60B,93C 'explicit':113C 'exploit':20B 'fix':86C 'flaw':38B 'groovi':47B 'host':25B 'incorrect':1A,36B,64C 'issu':71C,88C 'java':21B 'let':40B 'mean':57B 'met':104C 'ofbiz':6A,14A,16A,19B,27B,54B,69C,74C 'open':30B 'open-sourc':29B 'packag':22B 'payload':48B,50B 'permiss':117C 'precondit':102C 'process':55B 'recommend':79C 'reli':120C 'remot':43B,58B 'render':96C 'run':51B 'screen':95C,99C,109C 'self':24B 'self-host':23B 'send':45B 'server':63B 'sourc':31B 'suit':33B 'unauthent':42B,89C 'upgrad':81C 'user':77C,115C 'version':83C 'vulner':3A,66C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-08-05T09:15:56+00:00","kev":{"dateAdded":"2024-08-27","dueDate":"2024-09-17","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-38856","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38856","severity":null,"published_at":"2024-08-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-38856","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38856","severity":null,"published_at":"2024-08-05T09:15:56+00:00","modified_at":"2026-06-17T07:41:08+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}