Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-38856— Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Quick assessment

Affected
Apache Software Foundation Apache OFBiz
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache OFBiz是美国阿帕奇（Apache）基金会的一套企业资源计划（ERP）系统。该系统提供了一整套基于Java的Web应用程序组件和工具。 Apache OFBiz 18.12.14及之前版本存在安全漏洞，该漏洞源于存在授权错误漏洞，从而导致未经身份验证的端点可执行屏幕渲染代码。

AI Predicted 8.5 Difficulty: Moderate KEV EPSS 99.43% · P100
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-38856

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Apache OFBiz 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OFBiz是美国阿帕奇（Apache）基金会的一套企业资源计划（ERP）系统。该系统提供了一整套基于Java的Web应用程序组件和工具。 Apache OFBiz 18.12.14及之前版本存在安全漏洞，该漏洞源于存在授权错误漏洞，从而导致未经身份验证的端点可执行屏幕渲染代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache OFBiz 0 ~ 18.12.14 -

II. Public POCs for CVE-2024-38856

# POC Description Source Link Shenlong Link
1 None https://github.com/Disseminator/Poc_CVE-2024-38856 POC Details
2 Apache OFBiz RCE Scanner & Exploit (CVE-2024-38856) https://github.com/securelayer7/CVE-2024-38856_Scanner POC Details
3 Perform With Massive Apache OFBiz Zero-Day Scanner & RCE https://github.com/ThatNotEasy/CVE-2024-38856 POC Details
4 Exploit for CVE-2024-38856 affecting Apache OFBiz versions before 18.12.15 https://github.com/Praison001/CVE-2024-38856-ApacheOfBiz POC Details
5 CVE-2024-38856 Exploit https://github.com/0x20c/CVE-2024-38856-EXP POC Details
6 Nuclei template to scan for Apache Ofbiz affecting versions before 18.12.15 https://github.com/emanueldosreis/CVE-2024-38856 POC Details
7 Apache OFBiz CVE-2024-38856 https://github.com/BBD-YZZ/CVE-2024-38856-RCE POC Details
8 CVE-2024-38856 是 Apache OFBiz 中的一个严重漏洞，允许未经身份验证的攻击者在受影响的系统上执行任意代码。 https://github.com/XiaomingX/cve-2024-38856-poc POC Details
9 Tentang Pemindai & Eksploitasi Apache OFBiz RCE (CVE-2024-38856) https://github.com/FakesiteSecurity/CVE-2024-38856_Scen POC Details
10 Exploit for Apache OFBiz - CVE-2024-38856 https://github.com/AlissonFaoli/Apache-OFBiz-Exploit POC Details
11 Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints). https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38856.yaml POC Details
12 None https://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Apache%20OFBiz%20%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81%E7%BB%95%E8%BF%87%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%20CVE-2024-38856.md POC Details
13 https://github.com/vulhub/vulhub/blob/master/ofbiz/CVE-2024-38856/README.md POC Details
14 CVE-2024-38856: Apache OFBiz remote code execution Scanner & Exploit https://github.com/Hex00-0x4/CVE-2024-38856-Apache-OFBiz POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-38856

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-38856 (1)

Other References for CVE-2024-38856 (1)

Same Patch Batch · Apache Software Foundation · 2024-08-05 · 3 CVEs total

CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)
CVE-2024-42447 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for

IV. Related Vulnerabilities

Same product: Apache OFBiz
Same vendor: Apache Software Foundation
Same weakness: CWE-863

V. Comments for CVE-2024-38856

No comments yet

Leave a comment