cvelistv5 - cve-2024-45195

CVE-2024-45195 (GCVE-0-2024-45195)

Vulnerability from cvelistv5 – Published: 2024-09-04 08:08 – Updated: 2025-10-21 22:55

CISA

Summary

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Severity ?

No CVSS data available.

CWE

CWE-425 - Direct Request ('Forced Browsing')

Assigner

apache

References

URL

	Vendor	Product	Version
	Apache Software Foundation	Apache OFBiz	Affected: 0 , < 18.12.16 (custom)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2025-02-04

Due date: 2025-02-25

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Used in ransomware: Unknown

Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://ofbiz.apache.org/security.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-45195

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-04T09:03:00.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/09/03/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "ofbiz",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "18.12.16",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45195",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T15:46:50.643589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-02-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:46.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-02-04T00:00:00+00:00",
            "value": "CVE-2024-45195 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache OFBiz",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "18.12.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shin24 from National Cyber Security Vietnam"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "LuanPV from National Cyber Security Vietnam"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryan Emmons, Lead Security Researcher at Rapid7"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hasib Vhora, Senior Threat Researcher, SonicWall"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Xenc from SGLAB of Legendsec at Qi\u0027anxin Group"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDirect Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\u003c/p\u003e\u003cp\u003eThis issue affects Apache OFBiz: before 18.12.16.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 18.12.16, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Direct Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 18.12.16.\n\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-425",
              "description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T08:08:59.201Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "mitigation",
            "product",
            "release-notes"
          ],
          "url": "https://ofbiz.apache.org/download.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://ofbiz.apache.org/security.html"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/OFBIZ-13130"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache OFBiz: Confused controller-view authorization logic (forced browsing)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-45195",
    "datePublished": "2024-09-04T08:08:59.201Z",
    "dateReserved": "2024-08-22T15:19:27.892Z",
    "dateUpdated": "2025-10-21T22:55:46.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-45195",
      "cwes": "[\"CWE-425\"]",
      "dateAdded": "2025-02-04",
      "dueDate": "2025-02-25",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://ofbiz.apache.org/security.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-45195",
      "product": "OFBiz",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.",
      "vendorProject": "Apache",
      "vulnerabilityName": "Apache OFBiz Forced Browsing Vulnerability"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.12.16\", \"matchCriteriaId\": \"51868E3D-516B-4DF1-8889-161D53E47ACE\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Direct Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\\n\\nThis issue affects Apache OFBiz: before 18.12.16.\\n\\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad Direct Request (\\\"Navegaci\\u00f3n forzada\\\") en Apache OFBiz. Este problema afecta a Apache OFBiz: anterior a la versi\\u00f3n 18.12.16. Se recomienda a los usuarios que actualicen a la versi\\u00f3n 18.12.16, que soluciona el problema.\"}]",
      "id": "CVE-2024-45195",
      "lastModified": "2024-11-21T09:37:28.073",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-09-04T09:15:04.397",
      "references": "[{\"url\": \"https://issues.apache.org/jira/browse/OFBIZ-13130\", \"source\": \"security@apache.org\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy\", \"source\": \"security@apache.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://ofbiz.apache.org/download.html\", \"source\": \"security@apache.org\", \"tags\": [\"Product\"]}, {\"url\": \"https://ofbiz.apache.org/security.html\", \"source\": \"security@apache.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/09/03/6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-425\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45195\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-09-04T09:15:04.397\",\"lastModified\":\"2025-10-23T14:49:13.317\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Direct Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\\n\\nThis issue affects Apache OFBiz: before 18.12.16.\\n\\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad Direct Request (\\\"Navegaci\u00f3n forzada\\\") en Apache OFBiz. Este problema afecta a Apache OFBiz: anterior a la versi\u00f3n 18.12.16. Se recomienda a los usuarios que actualicen a la versi\u00f3n 18.12.16, que soluciona el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2025-02-04\",\"cisaActionDue\":\"2025-02-25\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Apache OFBiz Forced Browsing Vulnerability\",\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-425\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.12.16\",\"matchCriteriaId\":\"51868E3D-516B-4DF1-8889-161D53E47ACE\"}]}]}],\"references\":[{\"url\":\"https://issues.apache.org/jira/browse/OFBIZ-13130\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy\",\"source\":\"security@apache.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://ofbiz.apache.org/download.html\",\"source\":\"security@apache.org\",\"tags\":[\"Product\"]},{\"url\":\"https://ofbiz.apache.org/security.html\",\"source\":\"security@apache.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/09/03/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Apache OFBiz\", \"vendor\": \"Apache Software Foundation\", \"versions\": [{\"lessThan\": \"18.12.16\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"shin24 from National Cyber Security Vietnam\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"LuanPV from National Cyber Security Vietnam\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Ryan Emmons, Lead Security Researcher at Rapid7\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Hasib Vhora, Senior Threat Researcher, SonicWall\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Xenc from SGLAB of Legendsec at Qi\u0027anxin Group\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eDirect Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\u003c/p\u003e\u003cp\u003eThis issue affects Apache OFBiz: before 18.12.16.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 18.12.16, which fixes the issue.\u003c/p\u003e\"}], \"value\": \"Direct Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\\n\\nThis issue affects Apache OFBiz: before 18.12.16.\\n\\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue.\"}], \"metrics\": [{\"other\": {\"content\": {\"text\": \"important\"}, \"type\": \"Textual description of severity\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-425\", \"description\": \"CWE-425 Direct Request (\u0027Forced Browsing\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-09-04T08:08:59.201Z\"}, \"references\": [{\"tags\": [\"mitigation\", \"product\", \"release-notes\"], \"url\": \"https://ofbiz.apache.org/download.html\"}, {\"tags\": [\"patch\"], \"url\": \"https://ofbiz.apache.org/security.html\"}, {\"tags\": [\"issue-tracking\"], \"url\": \"https://issues.apache.org/jira/browse/OFBIZ-13130\"}, {\"tags\": [\"vendor-advisory\"], \"url\": \"https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"title\": \"Apache OFBiz: Confused controller-view authorization logic (forced browsing)\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/09/03/6\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-09-04T09:03:00.547Z\"}}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45195\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T15:46:50.643589Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-02-04\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*\"], \"vendor\": \"apache\", \"product\": \"ofbiz\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"18.12.16\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-04T15:17:41.720Z\"}, \"timeline\": [{\"time\": \"2025-02-04T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2024-45195 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45195\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2024-08-22T15:19:27.892Z\", \"datePublished\": \"2024-09-04T08:08:59.201Z\", \"dateUpdated\": \"2025-10-21T19:44:24.001Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-45195

Vulnerability from fkie_nvd - Published: 2024-09-04 09:15 - Updated: 2025-10-23 14:49

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

References

URL	Tags
security@apache.org	https://issues.apache.org/jira/browse/OFBIZ-13130	Issue Tracking, Vendor Advisory
security@apache.org	https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy	Vendor Advisory
security@apache.org	https://ofbiz.apache.org/download.html	Product
security@apache.org	https://ofbiz.apache.org/security.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2024/09/03/6	Mailing List
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195	Third Party Advisory, US Government Resource

Impacted products

	Vendor	Product	Version
	apache	ofbiz	*

JSON

To clipboard

{
  "cisaActionDue": "2025-02-25",
  "cisaExploitAdd": "2025-02-04",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Apache OFBiz Forced Browsing Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "51868E3D-516B-4DF1-8889-161D53E47ACE",
              "versionEndExcluding": "18.12.16",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Direct Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 18.12.16.\n\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad Direct Request (\"Navegaci\u00f3n forzada\") en Apache OFBiz. Este problema afecta a Apache OFBiz: anterior a la versi\u00f3n 18.12.16. Se recomienda a los usuarios que actualicen a la versi\u00f3n 18.12.16, que soluciona el problema."
    }
  ],
  "id": "CVE-2024-45195",
  "lastModified": "2025-10-23T14:49:13.317",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-04T09:15:04.397",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://issues.apache.org/jira/browse/OFBIZ-13130"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Product"
      ],
      "url": "https://ofbiz.apache.org/download.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://ofbiz.apache.org/security.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/09/03/6"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-HRMF-4PVG-RF3X

Vulnerability from github – Published: 2024-09-04 09:30 – Updated: 2025-10-22 00:33

Details

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-04T09:15:04Z",
    "severity": "HIGH"
  },
  "details": "Direct Request (\u0027Forced Browsing\u0027) vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 18.12.16.\n\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue.",
  "id": "GHSA-hrmf-4pvg-rf3x",
  "modified": "2025-10-22T00:33:06Z",
  "published": "2024-09-04T09:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45195"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/OFBIZ-13130"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy"
    },
    {
      "type": "WEB",
      "url": "https://ofbiz.apache.org/download.html"
    },
    {
      "type": "WEB",
      "url": "https://ofbiz.apache.org/security.html"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/09/03/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-2043

Vulnerability from csaf_certbund - Published: 2024-09-03 22:00 - Updated: 2024-09-12 22:00

Summary

Apache OFBiz: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Apache OFBiz ist eine Suite von Unternehmensanwendungen und ein Framework zur Entwicklung weiterer Anwendungen.

Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache OFBiz ist eine Suite von Unternehmensanwendungen und ein Framework zur Entwicklung weiterer Anwendungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-2043 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2043.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-2043 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2043"
      },
      {
        "category": "external",
        "summary": "OSS Security Mailing List vom 2024-09-03",
        "url": "https://seclists.org/oss-sec/2024/q3/242"
      },
      {
        "category": "external",
        "summary": "OSS Security Mailing List vom 2024-09-03",
        "url": "https://seclists.org/oss-sec/2024/q3/243"
      },
      {
        "category": "external",
        "summary": "Imperva Blog vom 2024-09-12",
        "url": "https://www.imperva.com/blog/imperva-protects-against-critical-apache-ofbiz-vulnerability/"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache OFBiz: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-09-12T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-13T08:08:52.745+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-2043",
      "initial_release_date": "2024-09-03T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-09-03T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-09-12T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE-2024-45195 wird ausgenutzt"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c18.12.16",
                "product": {
                  "name": "Apache OFBiz \u003c18.12.16",
                  "product_id": "T037259"
                }
              },
              {
                "category": "product_version",
                "name": "18.12.16",
                "product": {
                  "name": "Apache OFBiz 18.12.16",
                  "product_id": "T037259-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:ofbiz:18.12.16"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OFBiz"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45195",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Apache OFBiz. Diese Fehler sind auf fehlende Berechtigungspr\u00fcfungen und eine unzureichende Validierung von URLs zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037259"
        ]
      },
      "release_date": "2024-09-03T22:00:00.000+00:00",
      "title": "CVE-2024-45195"
    },
    {
      "cve": "CVE-2024-45507",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Apache OFBiz. Diese Fehler sind auf fehlende Berechtigungspr\u00fcfungen und eine unzureichende Validierung von URLs zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037259"
        ]
      },
      "release_date": "2024-09-03T22:00:00.000+00:00",
      "title": "CVE-2024-45507"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-45195 (GCVE-0-2024-45195)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

FKIE_CVE-2024-45195

GHSA-HRMF-4PVG-RF3X

WID-SEC-W-2024-2043

Tags

Sightings

Nomenclature