CVE-2024-38856

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,4%

Kerentanan Incorrect Authorization pada apache ofbiz. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 27 Agustus 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Rincian

Terbit di NVD

5 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

99,4% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache OFBiz Incorrect Authorization Vulnerability

Masuk KEV

27 Agustus 2024

Tenggat CISA

17 September 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w mailing list · advisory vendor
• https://ofbiz.apache.org/security.html patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856 advisory pihak ketiga · pemerintah AS
• https://issues.apache.org/jira/browse/OFBIZ-13128 issue tracking
• https://ofbiz.apache.org/download.html product
• http://www.openwall.com/lists/oss-security/2024/08/04/1 mailing list