Vulnerability-Lookup

GHSA-GP2R-34C8-48XQ

Vulnerability from github – Published: 2024-08-05 09:30 – Updated: 2025-10-22 00:33

Details

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-38856"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-05T09:15:56Z",
    "severity": "HIGH"
  },
  "details": "Incorrect Authorization vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: through 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\n\nUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don\u0027t explicitly check user\u0027s permissions because they rely on the configuration of their endpoints).",
  "id": "GHSA-gp2r-34c8-48xq",
  "modified": "2025-10-22T00:33:04Z",
  "published": "2024-08-05T09:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38856"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/OFBIZ-13128"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w"
    },
    {
      "type": "WEB",
      "url": "https://ofbiz.apache.org/download.html"
    },
    {
      "type": "WEB",
      "url": "https://ofbiz.apache.org/security.html"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/08/04/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-38856 (GCVE-0-2024-38856)

Vulnerability from cvelistv5 – Published: 2024-08-05 08:20 – Updated: 2025-10-21 22:55

Title

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Summary

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-31 03:55 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1090 records in the last 180 days details

References

6 references

URL	Tags
https://ofbiz.apache.org/download.html	productmitigation
https://ofbiz.apache.org/security.html	related
https://lists.apache.org/thread/olxxjk6b13sl3wh9c…	vendor-advisory
https://issues.apache.org/jira/browse/OFBIZ-13128	issue-tracking
http://www.openwall.com/lists/oss-security/2024/08/04/1
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

2 products

Vendor	Product	Version
Apache Software Foundation	Apache OFBiz	Affected: 0 , ≤ 18.12.14 (custom)
apache	ofbiz	Affected: 0 , ≤ 18.12.14 (custom) cpe:2.3:a:apache:ofbiz::::::::

Credits

unam4 ruozhi m1sn0w kuiplatain PaperPen@Timeline Sec RacerZ e0mlja Donghyun 4ra1n godspeed Hasib Vhora pwnull blckder02-YHLab Xenc from SGLAB of Legendsec at Qi'anxin Group Nicholas Zubrisky. Y4tacker

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:02:45.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/08/04/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "ofbiz",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "18.12.14",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38856",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-31T03:55:28.345914Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-27",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:48.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-08-27T00:00:00.000Z",
            "value": "CVE-2024-38856 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache OFBiz",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "18.12.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "unam4"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "ruozhi"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "m1sn0w"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "kuiplatain"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "PaperPen@Timeline Sec"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "RacerZ"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "e0mlja"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Donghyun"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "4ra1n"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "godspeed"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hasib Vhora"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "pwnull"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "blckder02-YHLab"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Xenc from SGLAB of Legendsec at Qi\u0027anxin Group"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nicholas Zubrisky."
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Y4tacker"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Authorization vulnerability in Apache OFBiz.\u003c/p\u003e\u003cp\u003eThis issue affects Apache OFBiz: through 18.12.14.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\u003c/p\u003eUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don\u0027t explicitly check user\u0027s permissions because they rely on the configuration of their endpoints).\u003cbr\u003e"
            }
          ],
          "value": "Incorrect Authorization vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: through 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\n\nUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don\u0027t explicitly check user\u0027s permissions because they rely on the configuration of their endpoints)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-05T08:20:18.081Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "product",
            "mitigation"
          ],
          "url": "https://ofbiz.apache.org/download.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://ofbiz.apache.org/security.html"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/OFBIZ-13128"
        }
      ],
      "source": {
        "defect": [
          "OFBIZ-13128"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-38856",
    "datePublished": "2024-08-05T08:20:18.081Z",
    "dateReserved": "2024-06-20T07:28:36.680Z",
    "dateUpdated": "2025-10-21T22:55:48.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted