CVE-2024-38856

Some Apache OFBiz endpoints do not require authentication and, when certain preconditions are met, allow execution of screen rendering code. The problem stems from the fact that screen definitions do not explicitly check user permissions, relying solely on the configuration of their own endpoints. An attacker can craft an appropriate request to the vulnerable endpoint and cause unintended server-side code execution without possessing any credentials.

An unauthenticated remote attacker can execute code on the server side, which consequently leads to complete violation of system confidentiality, integrity, and availability.

Apache OFBiz must be immediately updated to version 18.12.15, which contains a patch eliminating this vulnerability.

Apache OFBiz in all versions up to and including 18.12.14.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.