Skip to main content

Ofbiz CVE-2024-45195

HIGH
Direct Request ('Forced Browsing') (CWE-425)
2024-09-04 security@apache.org
Apache Information Disclosure Ofbiz
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Added to CISA KEV
Jul 14, 2026 - 04:22 CISA
CVE Published
Sep 04, 2024 - 09:15 nvd
HIGH 7.5

DescriptionNVD

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.

AnalysisAI

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-425. Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. Affected products include: Apache Ofbiz. Version information: before 18.12.16..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Ofbiz

View all
CVE-2024-38856 CRITICAL POC
9.8 Aug 05

Incorrect Authorization vulnerability in Apache OFBiz.12.14. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2024-32113 CRITICAL POC
9.8 May 08

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.13. Rate
CVE-2023-51467 CRITICAL POC
9.8 Dec 26

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary

CVE-2023-49070 CRITICAL POC
9.8 Dec 05

Pre-auth RCE in Apache Ofbiz 18.12.09. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, n
CVE-2021-26295 CRITICAL POC
9.8 Mar 22

Apache OFBiz has unsafe deserialization prior to 17.12.06. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2024-45507 CRITICAL POC
9.8 Sep 04

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OF
CVE-2021-30128 CRITICAL POC
9.8 Apr 27

Apache OFBiz has unsafe deserialization prior to 17.12.07 version. Rated critical severity (CVSS 9.8), this vulnerabilit
CVE-2021-29200 CRITICAL POC
9.8 Apr 27

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack. Rat
CVE-2024-36104 CRITICAL POC
9.1 Jun 04

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.14. Rate
CVE-2020-9496 MEDIUM POC
6.1 Jul 15

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03. Rated
CVE-2016-2170 CRITICAL
9.8 Apr 12

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands vi
CVE-2023-50968 HIGH POC
7.5 Dec 26

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri cal

Same weakness CWE-425 – Direct Request ('Forced Browsing')

View all
CVE-2017-14244 CRITICAL POC
9.8
CVE-2024-0204 CRITICAL POC
9.8
CVE-2017-15235 HIGH POC
7.5
CVE-2024-24592 CRITICAL POC
9.8
CVE-2022-45276 CRITICAL POC
9.8
CVE-2022-26279 CRITICAL POC
9.8
CVE-2021-36560 CRITICAL POC
9.8
CVE-2020-24660 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-45195 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy