EUVD-2026-30870
GHSA-7fjv-4hxj-5chr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing OFBiz endpoint
-
ExploitCraft request with attacker-controlled URL
-
ExecutionServer fetches internal/metadata target
-
ImpactExfiltrate internal response data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against network-reachable Apache OFBiz instances before 24.09.06, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires that the OFBiz server itself be able to reach a target of interest (internal service, cloud metadata endpoint, or other back-end host), so the practical value is limited by the server's own network position and egress rules; SSRF impact here is confidentiality-only (C:H/I:N/A:N), meaning an attacker reads or probes reachable resources rather than executing code. The exact vulnerable feature or parameter is not specified in the advisory, which limits precise pre-conditions. |
| Impact | The signals are consistent but point to latent rather than imminent risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easy, network-reachable, unauthenticated attack, and SSVC rates it Automatable:yes with partial technical impact - both suggesting it could be scripted at scale. Counterbalancing this, EPSS is only 0.02% (4th percentile), SSVC Exploitation is 'none', and no KEV listing or public POC exists, so real-world exploitation is currently not observed. The C:H/I:N/A:N profile means impact is bounded to information disclosure (reading internal/blind SSRF targets), not server compromise, which tempers the 7.5 score. Net: a genuine, easily automatable exposure worth patching promptly on internet-facing OFBiz instances, but not an active-exploitation emergency based on available data. No conflicting signals were identified between the CVSS vector and the SSRF description. |
| Exploit ScenarioDerived | An attacker sends a crafted request to an internet-facing OFBiz endpoint containing a URL or host parameter pointing at an internal resource such as a cloud metadata service or an internal admin API. The server dutifully fetches that URL and returns or leaks the response, allowing the attacker to harvest internal data or credentials. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), and no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests, enabling access to internal-only services, cloud metadata endpoints, and other network resources normally shielded from the internet. The CVSS 3.1 vector (7.5, C:H) reflects confidentiality-only impact, consistent with data exfiltration from internal targets rather than direct code execution. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile), indicating no observed exploitation activity despite the network-reachable, no-privilege attack surface.
RemediationAI
Vendor-released patch: upgrade Apache OFBiz to version 24.09.06, which fixes the issue, as directed by the Apache advisory at https://lists.apache.org/thread/2smc4c4o056ovd2hoq1l29593y5y29vh. Until the upgrade can be applied, reduce exposure by placing the OFBiz application behind a reverse proxy or firewall that restricts its outbound network egress so the server cannot reach internal address ranges or cloud metadata endpoints (e.g. 169.254.169.254), and restrict inbound access to the affected request handlers to trusted networks or authenticated users; be aware that egress filtering can break legitimate integrations that call external services, and inbound restrictions may impede public storefront functionality, so validate these controls against your deployment before enforcing them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache OFBiz is a Java-based open-source enterprise resource planning (ERP) and e-commerce suite bundling accounting, CRM, order management, and a web storefront on an embedded application server. The flaw is classified CWE-918 (Server-Side Request Forgery), the root-cause class where a server fetches a user-supplied URL or host without adequately validating or restricting the destination, letting an attacker repurpose the server as a proxy into networks it can reach. The affected component is identified only by CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*, covering all Apache OFBiz builds prior to the fixed 24.09.06 release; the specific vulnerable request handler or feature is not detailed in the advisory.
Know when Apache Ofbiz gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated SSRF with low complexity (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only information disclosure, so C:H and I:A:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Executive ViewAI
Apache OFBiz versions before 24.09.06 contain a server-side request forgery (SSRF) vulnerability allowing unauthenticated attackers to access internal services and cloud metadata endpoints from the internet-creating a direct pathway for credential theft and lateral network movement. Any organization with internet-facing OFBiz deployments faces confidentiality risk from external adversaries without requiring any authentication or user interaction. While exploitation activity is currently minimal, the HIGH severity rating (CVSS 7.5) and low barriers to attack demand rapid remediation before threat actors expand focus to this vulnerability class.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Apache Ofbiz
View allRemote code execution in Apache OFBiz before 24.09.06 stems from an improper authentication flaw in the password-change
Remote unauthenticated code execution in Apache OFBiz 24.09 before 24.09.08 allows an attacker to execute arbitrary comm
Unauthenticated resource exhaustion affects Apache OFBiz installations running in multitenant mode, where a remote clien
LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into
Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic k
Authenticated code injection in Apache OFBiz versions prior to 24.09.06 allows remote attackers with low-privileged acco
Authenticated command execution in Apache OFBiz 24.09 (before 24.09.08) lets a low-privileged user escalate from view-on
Authenticated code injection in the Apache OFBiz cms plugin allows a CMS content-editor to run arbitrary operating syste
Authenticated OS command execution in Apache OFBiz 24.09 before 24.09.08 lets a low-privileged accounting user run arbit
Authenticated users who hold access to the Sales Force Automation (SFA) component in Apache OFBiz before 24.09.08 can su
Improper authorization in the OFBiz ContentWorker lets a remote unauthenticated attacker invoke an arbitrary OFBiz servi
Unauthenticated remote attackers can bypass the request-map authentication policy in Apache OFBiz 24.09 (before 24.09.08
Exploit-DB