Apache · OFBiz
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Qué es
Incorrect Authorization vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: through 18.12.14.
Users are recommended to upgrade to version 18.12.15, which fixes the issue.
Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
CISA: Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Qué hacer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 17 de septiembre de 2024
Más fallos explotados de Apache
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 4 feb 2025 | Forced Browsing | OFBiz | Crítica 9,8 | >99,9% |
| 7 ago 2024 | Path Traversal | OFBiz | Crítica 9,1 | 99,9% |
| 8 oct 2026 | Command Injection | Struts | Alto 8,1 | 97% |
| 4 ago 2026 | Missing Encryption of Sensitive Data | Tomcat | Alto 7,5 | 99% |
| 16 abr 2026 | Improper Input Validation | ActiveMQ | Alto 8,8 | 98% |
| 1 may 2025 | Improper Escaping of Output | HTTP Server | Crítica 9,1 | >99,9% |
| 1 abr 2025 | Path Equivalence | Tomcat | Crítica 10,0 | 99,9% |
| 18 sept 2024 | Improper Access Control | HugeGraph-Server | Crítica 9,8 | 99,2% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.