Apache · OFBiz
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Cos'è
Incorrect Authorization vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: through 18.12.14.
Users are recommended to upgrade to version 18.12.15, which fixes the issue.
Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
CISA: Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Cosa fare
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 17 settembre 2024
Altre falle sfruttate di Apache
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 4 feb 2025 | Forced Browsing | OFBiz | Critica 9,8 | >99,9% |
| 7 ago 2024 | Path Traversal | OFBiz | Critica 9,1 | 99,9% |
| 8 ott 2026 | Command Injection | Struts | Alta 8,1 | 97% |
| 4 ago 2026 | Missing Encryption of Sensitive Data | Tomcat | Alta 7,5 | 99% |
| 16 apr 2026 | Improper Input Validation | ActiveMQ | Alta 8,8 | 98% |
| 1 mag 2025 | Improper Escaping of Output | HTTP Server | Critica 9,1 | >99,9% |
| 1 apr 2025 | Path Equivalence | Tomcat | Critica 10,0 | 99,9% |
| 18 set 2024 | Improper Access Control | HugeGraph-Server | Critica 9,8 | 99,2% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.