Critical severity9.8CISA KEVNVD Advisory· Published Aug 5, 2024· Updated Jun 17, 2026

CVE-2024-38856

Description

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Ofbiz3 versions
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*range: <18.12.15
- (no CPE)range: <=18.12.14
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

ofbiz.apache.org/security.htmlnvdPatch
lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7wnvdMailing ListVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdThird Party AdvisoryUS Government Resource
www.openwall.com/lists/oss-security/2024/08/04/1nvdMailing List
issues.apache.org/jira/browse/OFBIZ-13128nvdIssue Tracking
ofbiz.apache.org/download.htmlnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.080
exploit	0.030
kev	0.120
patch	-0.070
ransomware	0.000