Apache Ofbiz
Monthly
An authentication bypass in Apache OFBiz through 24.09.07 lets remote, unauthenticated attackers invoke REST API operations that were meant to require credentials, because the ModelApiReader parser resolves an omitted auth attribute in .rest.xml definitions to false rather than the true default declared by rest-api.xsd. Only deployments that define REST resources or operations without an explicit auth attribute are exposed, and the realized impact is bounded (C:L/I:L/A:L) since the blast radius depends on which operations lack the attribute. EPSS is low at 0.22% (13th percentile) and no public exploit code or CISA KEV entry is associated with the issue at time of analysis, though a public PoC reference exists that is not verified as working exploit code; upgrading to 24.09.08 fixes the flaw.
Authenticated command execution in Apache OFBiz 24.09 (before 24.09.08) lets a low-privileged user escalate from view-only access to running arbitrary commands as the OFBiz process user. The broken authorization check in the updateLayout simple-method only validates the fixed CONTENT_CREATE operation instead of an update permission on the specific Content record and DataResource, so an attacker holding just OFBTOOLS_VIEW and CONTENTMGR_VIEW can relink a RESPONSE-purpose Content record, convert an attacker-chosen DataResource into an OFBIZ_FILE/FTL resource, point it at the OFBiz access log and have a crafted User-Agent payload evaluated through the normal authenticated showContent route. No public exploit code has been identified at time of analysis, but the flaw is rated CVSS 8.8 with high confidentiality, integrity and availability impact and is treated as a this-week priority; exploitation is not anonymous - a valid account with those two view permissions is required, and only the 24.09 branch before 24.09.08 is affected.
Remote unauthenticated attackers can read protected views in Apache OFBiz 24.09 through 24.09.07 by appending a protected view name as a path suffix to a public control request (for example /catalog/control/ListLocales/showPortalPage), because RequestHandler authorizes only the public path component while still rendering the protected suffix view. The flaw is rated CVSS 7.5 (CWE-288, incorrect authorization) with impact limited to confidentiality - protected views can be disclosed, but the bypass does not grant authenticated actions. EPSS is low at 0.30% (23rd percentile), no CISA KEV entry or confirmed public exploit is available, and the vendor-released fix is Apache OFBiz 24.09.08.
Authenticated code injection in the Apache OFBiz cms plugin allows a CMS content-editor to run arbitrary operating system commands as the OFBiz process user with a single HTTP POST. The flaw exists because the EditAddContent handler copies the caContentIdTo request parameter into a top-level context variable, which is interpolated into a form field's use-when attribute and passed unvalidated to GroovyUtil.eval(); the compile-time SecureASTCustomizer sandbox does not constrain runtime reflection, so a crafted payload can break out of the expanded string literal and invoke java.lang.Runtime. All OFBiz deployments with the cms plugin before 24.09.08 are affected, exploitation requires valid content-editor credentials (PR:L) with no user interaction, and the vendor has released a fix in 24.09.08.
Unauthenticated resource exhaustion affects Apache OFBiz installations running in multitenant mode, where a remote client can force unbounded growth of the DelegatorFactory cache and sustained database load simply by submitting a stream of arbitrary userTenantId values. Exposure is narrow but severe where it applies: only versions before 24.09.08 that actually enable multitenant deployments exercise the vulnerable ContextFilter/LoginWorker lookup path, while the default single-tenant configuration is not affected. The assessed vector is availability-only (no confidentiality or integrity impact), no public exploit code has been identified at time of analysis, and EPSS is low at 0.20% (10th percentile) - but with a vendor patch released and an act_now prioritization signal, multitenant instances should be upgraded promptly.
Authenticated users who hold access to the Sales Force Automation (SFA) component in Apache OFBiz before 24.09.08 can substitute an attacker-chosen service identifier during vcard import, causing the application to invoke a different, unauthorized service. The flaw is scored CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and classified as CWE-99 resource injection, giving a low-privileged SFA user high confidentiality and integrity impact outside their intended privileges; exploitation requires valid credentials with SFA access, and no public exploit identified at time of analysis. The vendor fixed the issue in 24.09.08, the patch is available from the vendor, and the priority is 'this_week' - a genuine but conditional risk rather than a drop-everything emergency.
Unauthenticated code injection in Apache OFBiz allows remote attackers to make the application load an attacker-controlled Screen definition, which the widget engine then interprets as trusted presentation logic. All releases before 24.09.08 are affected, per the vendor advisory; the flaw combines abuse of temporary-file handling, access to an open file descriptor, and injection of a 'file:' URI into the Screen resolution path. An independent re-score raises the impact above the published 7.5 to include high integrity impact (C:H/I:H) rather than confidentiality only, and the EPSS score is low (0.22%, 12th percentile) with no CISA KEV entry and no public exploit code identified at time of analysis - the vendor patch to 24.09.08 is available, making this a this-week priority rather than an emergency.
Authenticated OS command execution in Apache OFBiz 24.09 before 24.09.08 lets a low-privileged accounting user run arbitrary commands as the OFBiz service account. A remote attacker who holds only the OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions can submit a ${groovy:...} expression through the bodyText or subject fields of the shipped 'Send Per Email' invoice form, which is evaluated by FlexibleStringExpander.expandString without the sandboxing applied elsewhere in the product. No user interaction is required and no public exploit code has been identified at time of analysis; the vendor has released 24.09.08 as the fix.
Missing ACCOUNTING_CREATE and ACCOUNTING_UPDATE permission checks on PaymentApplication in Apache OFBiz accounting let a user who holds only the ACCOUNTING_VIEW grant create and update PaymentApplication records, an integrity-impacting broken-access-control flaw (CWE-425, direct request/forced browsing) fixed in 24.09.08. All OFBiz instances older than 24.09.08 are affected; the actor must be a provisioned OFBiz user with at least ACCOUNTING_VIEW, although the published CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N) marks no privileges required, which conflicts with the described prerequisite and should be confirmed with the vendor. There is no CISA KEV entry and no public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), and the vendor-released fix is 24.09.08.
Improper authorization in the OFBiz ContentWorker lets a remote unauthenticated attacker invoke an arbitrary OFBiz service with parameters taken straight from the live HTTP request, producing arbitrary file write, arbitrary file deletion and server-side request forgery. The attack chain has two stages: an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE must first persist an attacker-chosen service name into a Content row's serviceName field, after which a request to the public showHelpPublic view causes ContentWorker.renderContentAsText to resolve and execute that stored service with no allow-list, no ownership check and no authentication requirement (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, integrity impact high, confidentiality and availability impact low). Only Apache OFBiz 24.09 releases before 24.09.08 are affected; no public exploit code has been identified at time of analysis and EPSS is 0.46% (40th percentile), so risk is real but not a top-tier emergency.
Apache OFBiz before 24.09.08 allows an authenticated user who holds only the ORDERMGR_VIEW permission to update orders through the ordermgr component, because the server-side update path fails to enforce the ORDERMGR_UPDATE permission. The authoritative assessment rates this as a low-privilege authenticated authorization bypass (PR:L) rather than an anonymous flaw, with high integrity impact and no confidentiality or availability impact. No public exploit was identified at the time of analysis and EPSS is 0.15% (4th percentile); the vendor has released 24.09.08 as the fix.
Remote unauthenticated code execution in Apache OFBiz 24.09 before 24.09.08 allows an attacker to execute arbitrary commands on the server by staging crafted widget XML in a multipart upload that is held in flight and overriding mainDecoratorLocation through an anonymous JSON request. The payload is loaded through OFBiz's live screen descriptor mechanism and an unsandboxed Groovy expression is evaluated during rendering; the same flaw is also reachable through the public /sfa/control/editPortalPageColumnWidth route, which can return command output in an HTTP 200 response. No public exploit is identified at time of analysis, and the vendor-released fix is 24.09.08.
Unauthenticated remote attackers can bypass the request-map authentication policy in Apache OFBiz 24.09 (before 24.09.08) and read protected views along with the business data those views expose. Supplying a crafted _LAST_VIEW_NAME_ value causes it to be persisted as saved-view state inside the anonymous session, and RequestHandler.renderView later renders that saved view without re-applying the original view's authentication requirement. Impact is confidentiality-only (C:H/I:N/A:N, CVSS 7.5); the issue is not in CISA KEV, no public exploit was identified at time of analysis, and EPSS is low at 0.33% (26th percentile), putting this at moderate priority rather than an emergency, although the fix is worth scheduling promptly given the unauthenticated network vector.
Authenticated code injection in Apache OFBiz versions prior to 24.09.06 allows remote attackers with low-privileged accounts to execute arbitrary code via improperly neutralized directives in dynamically evaluated expressions. The flaw combines CWE-94 code injection with eval injection, yielding full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and EPSS rates near-term exploitation at 0.03% (8th percentile), but SSVC flags the issue as automatable, raising the risk of scripted abuse once a POC emerges.
Remote code execution in Apache OFBiz before 24.09.06 stems from an improper authentication flaw in the password-change logic that allows unauthenticated remote attackers to bypass authentication and ultimately execute arbitrary code on the server. The CVSS 9.8 rating reflects network-reachable, no-interaction exploitation against a widely deployed open-source ERP platform, though EPSS sits at only 0.07% and SSVC currently marks exploitation as 'none' - meaning no public exploit identified at time of analysis despite the severe technical impact.
LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into LDAP queries, bypassing authentication or extracting directory data with high confidentiality and integrity impact. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 rating and CISA SSVC 'total' technical impact make it a meaningful patching priority. A vendor patch is available in version 24.09.06.
Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic key (CWE-321) shipped with the product, meaning every deployment shares the same secret. Remote unauthenticated attackers who know or extract this key from the open-source codebase can decrypt or forge protected data, undermining any cryptographic protection that relies on it. No public exploit is identified at time of analysis, and EPSS rates near-term exploitation probability very low (0.02%), but SSVC scores the technical impact as total and automatable.
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests, enabling access to internal-only services, cloud metadata endpoints, and other network resources normally shielded from the internet. The CVSS 3.1 vector (7.5, C:H) reflects confidentiality-only impact, consistent with data exfiltration from internal targets rather than direct code execution. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile), indicating no observed exploitation activity despite the network-reachable, no-privilege attack surface.
Information disclosure in Apache OFBiz before 24.09.06 lets remote unauthenticated attackers retrieve sensitive data they should not be able to access (CWE-200). The flaw is network-reachable with low complexity and no authentication (CVSS 7.5, C:H), though no public exploit identified at time of analysis and the EPSS score is very low (0.02%). Impact is limited to confidentiality only, with no integrity or availability effect.
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound requests through the Content component's operations. Exploitation can reach internal-only services, cloud metadata endpoints, and other network resources not otherwise accessible, with partial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low (0.02%).
Improper Authorization in Apache OFBiz Webtools allows unauthenticated remote attackers to bypass access controls and gain partial read and write access to restricted resources. All OFBiz releases before 24.09.06 are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though SSVC flags it as automatable - meaning scripted mass-scanning is feasible once a technique is published.
Code injection in Apache OFBiz's email services exposes all versions before 24.09.06 to unauthenticated remote exploitation via CWE-94. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and SSVC classifies the attack as automatable - meaning it can be scripted at scale. Despite the RCE tag attached by intelligence sources, CVSS impact metrics are capped at C:L/I:L/A:N and EPSS sits at 0.03% (8th percentile), indicating no public exploitation observed at time of analysis and no CISA KEV listing.
Cross-site scripting in Apache OFBiz before version 24.09.06 allows remote unauthenticated attackers to inject malicious scripts into web pages rendered in victims' browsers, enabling session hijacking, credential theft, or unauthorized ERP actions performed on behalf of the victim. The CVSS scope change (S:C) confirms the injected script escapes the OFBiz application context and executes in the victim's browser security domain. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS sits at 0.03% (8th percentile), and no public exploit code is referenced; however, a vendor-released patch to version 24.09.06 is available and should be applied.
Improper Access Control in Apache OFBiz multi-tenant deployments exposes confidential data across tenant boundaries to unauthenticated remote attackers via a network-accessible flaw (AV:N/PR:N). All versions prior to 24.09.06 are affected, limited to multi-tenant configurations. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 4th percentile indicates very low observed exploitation interest at time of analysis, though the attack is automatable per SSVC assessment.
Improper authentication in Apache OFBiz before version 24.09.06 permits unauthenticated remote attackers to bypass authentication controls and access limited confidential information without valid credentials. The flaw (CWE-287) is exploitable over the network with no privilege or user interaction requirements, affecting all OFBiz deployments on unpatched versions. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.02%; however, SSVC marks the attack path as automatable, making it a viable candidate for opportunistic scanning campaigns.
Expression Language Injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject and evaluate EL expressions through unsanitized application inputs, yielding partial confidentiality and integrity impact on the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is network-reachable with no authentication or user interaction, and SSVC classifies the attack as automatable - a meaningful signal given OFBiz's historical exposure to EL-class vulnerabilities. However, real-world urgency is moderated by a very low EPSS score (0.03%, 8th percentile), no public exploit code identified, and no active exploitation reported; vendor patch 24.09.06 is available.
Cross-site scripting, path traversal, and code injection vulnerabilities in Apache OFBiz before version 24.09.06 expose unauthenticated network attackers to the ability to inject malicious scripts into web pages rendered by authenticated users, with the scope change (S:C) in the CVSS vector indicating cross-origin impact such as session hijacking. The co-presence of path traversal and code injection primitives alongside XSS suggests potential for chained exploitation beyond a standard reflected XSS attack, though SSVC rates current exploitation as none and EPSS sits at 0.03% (9th percentile), indicating very low real-world exploitation probability at time of analysis. No public exploit code and no active exploitation (KEV) have been identified; vendor-released patch 24.09.06 is available.
Improper input validation in Apache OFBiz before 24.09.06 allows unauthenticated remote attackers to achieve partial confidentiality and integrity impact over the network with no attack complexity or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). SSVC analysis classifies the flaw as automatable with partial technical impact, meaning it is feasible for automated tools to probe and potentially exploit at scale. No active exploitation has been confirmed - EPSS stands at just 0.04% (11th percentile) and the vulnerability is absent from CISA KEV - indicating current real-world exploitation is unlikely despite the broadly accessible attack surface.
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Customer security group to inject malicious FreeMarker (FTL) template expressions via Data Resource records, yielding partial information disclosure and content integrity impact. The root cause is that the platform's Ecommerce Customer role carried content management grants by default, exposing the FTL template rendering engine to insufficiently trusted input. No public exploit has been identified at time of analysis and EPSS probability is very low (0.02%, 7th percentile), though SSVC flags the attack path as automatable once an account is obtained.
Path traversal in Apache OFBiz before 24.09.06 exposes unauthenticated remote attackers to file read and limited file write capabilities outside the application's intended directory boundaries. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication, no user interaction, and no special network position against any internet-exposed OFBiz instance. No public exploit has been identified at time of analysis and EPSS sits at 0.02% (6th percentile), but SSVC flags the attack as automatable - meaning if tooling emerges, mass internet scanning becomes feasible.
An authentication bypass in Apache OFBiz through 24.09.07 lets remote, unauthenticated attackers invoke REST API operations that were meant to require credentials, because the ModelApiReader parser resolves an omitted auth attribute in .rest.xml definitions to false rather than the true default declared by rest-api.xsd. Only deployments that define REST resources or operations without an explicit auth attribute are exposed, and the realized impact is bounded (C:L/I:L/A:L) since the blast radius depends on which operations lack the attribute. EPSS is low at 0.22% (13th percentile) and no public exploit code or CISA KEV entry is associated with the issue at time of analysis, though a public PoC reference exists that is not verified as working exploit code; upgrading to 24.09.08 fixes the flaw.
Authenticated command execution in Apache OFBiz 24.09 (before 24.09.08) lets a low-privileged user escalate from view-only access to running arbitrary commands as the OFBiz process user. The broken authorization check in the updateLayout simple-method only validates the fixed CONTENT_CREATE operation instead of an update permission on the specific Content record and DataResource, so an attacker holding just OFBTOOLS_VIEW and CONTENTMGR_VIEW can relink a RESPONSE-purpose Content record, convert an attacker-chosen DataResource into an OFBIZ_FILE/FTL resource, point it at the OFBiz access log and have a crafted User-Agent payload evaluated through the normal authenticated showContent route. No public exploit code has been identified at time of analysis, but the flaw is rated CVSS 8.8 with high confidentiality, integrity and availability impact and is treated as a this-week priority; exploitation is not anonymous - a valid account with those two view permissions is required, and only the 24.09 branch before 24.09.08 is affected.
Remote unauthenticated attackers can read protected views in Apache OFBiz 24.09 through 24.09.07 by appending a protected view name as a path suffix to a public control request (for example /catalog/control/ListLocales/showPortalPage), because RequestHandler authorizes only the public path component while still rendering the protected suffix view. The flaw is rated CVSS 7.5 (CWE-288, incorrect authorization) with impact limited to confidentiality - protected views can be disclosed, but the bypass does not grant authenticated actions. EPSS is low at 0.30% (23rd percentile), no CISA KEV entry or confirmed public exploit is available, and the vendor-released fix is Apache OFBiz 24.09.08.
Authenticated code injection in the Apache OFBiz cms plugin allows a CMS content-editor to run arbitrary operating system commands as the OFBiz process user with a single HTTP POST. The flaw exists because the EditAddContent handler copies the caContentIdTo request parameter into a top-level context variable, which is interpolated into a form field's use-when attribute and passed unvalidated to GroovyUtil.eval(); the compile-time SecureASTCustomizer sandbox does not constrain runtime reflection, so a crafted payload can break out of the expanded string literal and invoke java.lang.Runtime. All OFBiz deployments with the cms plugin before 24.09.08 are affected, exploitation requires valid content-editor credentials (PR:L) with no user interaction, and the vendor has released a fix in 24.09.08.
Unauthenticated resource exhaustion affects Apache OFBiz installations running in multitenant mode, where a remote client can force unbounded growth of the DelegatorFactory cache and sustained database load simply by submitting a stream of arbitrary userTenantId values. Exposure is narrow but severe where it applies: only versions before 24.09.08 that actually enable multitenant deployments exercise the vulnerable ContextFilter/LoginWorker lookup path, while the default single-tenant configuration is not affected. The assessed vector is availability-only (no confidentiality or integrity impact), no public exploit code has been identified at time of analysis, and EPSS is low at 0.20% (10th percentile) - but with a vendor patch released and an act_now prioritization signal, multitenant instances should be upgraded promptly.
Authenticated users who hold access to the Sales Force Automation (SFA) component in Apache OFBiz before 24.09.08 can substitute an attacker-chosen service identifier during vcard import, causing the application to invoke a different, unauthorized service. The flaw is scored CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and classified as CWE-99 resource injection, giving a low-privileged SFA user high confidentiality and integrity impact outside their intended privileges; exploitation requires valid credentials with SFA access, and no public exploit identified at time of analysis. The vendor fixed the issue in 24.09.08, the patch is available from the vendor, and the priority is 'this_week' - a genuine but conditional risk rather than a drop-everything emergency.
Unauthenticated code injection in Apache OFBiz allows remote attackers to make the application load an attacker-controlled Screen definition, which the widget engine then interprets as trusted presentation logic. All releases before 24.09.08 are affected, per the vendor advisory; the flaw combines abuse of temporary-file handling, access to an open file descriptor, and injection of a 'file:' URI into the Screen resolution path. An independent re-score raises the impact above the published 7.5 to include high integrity impact (C:H/I:H) rather than confidentiality only, and the EPSS score is low (0.22%, 12th percentile) with no CISA KEV entry and no public exploit code identified at time of analysis - the vendor patch to 24.09.08 is available, making this a this-week priority rather than an emergency.
Authenticated OS command execution in Apache OFBiz 24.09 before 24.09.08 lets a low-privileged accounting user run arbitrary commands as the OFBiz service account. A remote attacker who holds only the OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions can submit a ${groovy:...} expression through the bodyText or subject fields of the shipped 'Send Per Email' invoice form, which is evaluated by FlexibleStringExpander.expandString without the sandboxing applied elsewhere in the product. No user interaction is required and no public exploit code has been identified at time of analysis; the vendor has released 24.09.08 as the fix.
Missing ACCOUNTING_CREATE and ACCOUNTING_UPDATE permission checks on PaymentApplication in Apache OFBiz accounting let a user who holds only the ACCOUNTING_VIEW grant create and update PaymentApplication records, an integrity-impacting broken-access-control flaw (CWE-425, direct request/forced browsing) fixed in 24.09.08. All OFBiz instances older than 24.09.08 are affected; the actor must be a provisioned OFBiz user with at least ACCOUNTING_VIEW, although the published CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N) marks no privileges required, which conflicts with the described prerequisite and should be confirmed with the vendor. There is no CISA KEV entry and no public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), and the vendor-released fix is 24.09.08.
Improper authorization in the OFBiz ContentWorker lets a remote unauthenticated attacker invoke an arbitrary OFBiz service with parameters taken straight from the live HTTP request, producing arbitrary file write, arbitrary file deletion and server-side request forgery. The attack chain has two stages: an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE must first persist an attacker-chosen service name into a Content row's serviceName field, after which a request to the public showHelpPublic view causes ContentWorker.renderContentAsText to resolve and execute that stored service with no allow-list, no ownership check and no authentication requirement (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, integrity impact high, confidentiality and availability impact low). Only Apache OFBiz 24.09 releases before 24.09.08 are affected; no public exploit code has been identified at time of analysis and EPSS is 0.46% (40th percentile), so risk is real but not a top-tier emergency.
Apache OFBiz before 24.09.08 allows an authenticated user who holds only the ORDERMGR_VIEW permission to update orders through the ordermgr component, because the server-side update path fails to enforce the ORDERMGR_UPDATE permission. The authoritative assessment rates this as a low-privilege authenticated authorization bypass (PR:L) rather than an anonymous flaw, with high integrity impact and no confidentiality or availability impact. No public exploit was identified at the time of analysis and EPSS is 0.15% (4th percentile); the vendor has released 24.09.08 as the fix.
Remote unauthenticated code execution in Apache OFBiz 24.09 before 24.09.08 allows an attacker to execute arbitrary commands on the server by staging crafted widget XML in a multipart upload that is held in flight and overriding mainDecoratorLocation through an anonymous JSON request. The payload is loaded through OFBiz's live screen descriptor mechanism and an unsandboxed Groovy expression is evaluated during rendering; the same flaw is also reachable through the public /sfa/control/editPortalPageColumnWidth route, which can return command output in an HTTP 200 response. No public exploit is identified at time of analysis, and the vendor-released fix is 24.09.08.
Unauthenticated remote attackers can bypass the request-map authentication policy in Apache OFBiz 24.09 (before 24.09.08) and read protected views along with the business data those views expose. Supplying a crafted _LAST_VIEW_NAME_ value causes it to be persisted as saved-view state inside the anonymous session, and RequestHandler.renderView later renders that saved view without re-applying the original view's authentication requirement. Impact is confidentiality-only (C:H/I:N/A:N, CVSS 7.5); the issue is not in CISA KEV, no public exploit was identified at time of analysis, and EPSS is low at 0.33% (26th percentile), putting this at moderate priority rather than an emergency, although the fix is worth scheduling promptly given the unauthenticated network vector.
Authenticated code injection in Apache OFBiz versions prior to 24.09.06 allows remote attackers with low-privileged accounts to execute arbitrary code via improperly neutralized directives in dynamically evaluated expressions. The flaw combines CWE-94 code injection with eval injection, yielding full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and EPSS rates near-term exploitation at 0.03% (8th percentile), but SSVC flags the issue as automatable, raising the risk of scripted abuse once a POC emerges.
Remote code execution in Apache OFBiz before 24.09.06 stems from an improper authentication flaw in the password-change logic that allows unauthenticated remote attackers to bypass authentication and ultimately execute arbitrary code on the server. The CVSS 9.8 rating reflects network-reachable, no-interaction exploitation against a widely deployed open-source ERP platform, though EPSS sits at only 0.07% and SSVC currently marks exploitation as 'none' - meaning no public exploit identified at time of analysis despite the severe technical impact.
LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into LDAP queries, bypassing authentication or extracting directory data with high confidentiality and integrity impact. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but the CVSS 9.1 rating and CISA SSVC 'total' technical impact make it a meaningful patching priority. A vendor patch is available in version 24.09.06.
Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic key (CWE-321) shipped with the product, meaning every deployment shares the same secret. Remote unauthenticated attackers who know or extract this key from the open-source codebase can decrypt or forge protected data, undermining any cryptographic protection that relies on it. No public exploit is identified at time of analysis, and EPSS rates near-term exploitation probability very low (0.02%), but SSVC scores the technical impact as total and automatable.
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests, enabling access to internal-only services, cloud metadata endpoints, and other network resources normally shielded from the internet. The CVSS 3.1 vector (7.5, C:H) reflects confidentiality-only impact, consistent with data exfiltration from internal targets rather than direct code execution. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile), indicating no observed exploitation activity despite the network-reachable, no-privilege attack surface.
Information disclosure in Apache OFBiz before 24.09.06 lets remote unauthenticated attackers retrieve sensitive data they should not be able to access (CWE-200). The flaw is network-reachable with low complexity and no authentication (CVSS 7.5, C:H), though no public exploit identified at time of analysis and the EPSS score is very low (0.02%). Impact is limited to confidentiality only, with no integrity or availability effect.
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound requests through the Content component's operations. Exploitation can reach internal-only services, cloud metadata endpoints, and other network resources not otherwise accessible, with partial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low (0.02%).
Improper Authorization in Apache OFBiz Webtools allows unauthenticated remote attackers to bypass access controls and gain partial read and write access to restricted resources. All OFBiz releases before 24.09.06 are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though SSVC flags it as automatable - meaning scripted mass-scanning is feasible once a technique is published.
Code injection in Apache OFBiz's email services exposes all versions before 24.09.06 to unauthenticated remote exploitation via CWE-94. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and SSVC classifies the attack as automatable - meaning it can be scripted at scale. Despite the RCE tag attached by intelligence sources, CVSS impact metrics are capped at C:L/I:L/A:N and EPSS sits at 0.03% (8th percentile), indicating no public exploitation observed at time of analysis and no CISA KEV listing.
Cross-site scripting in Apache OFBiz before version 24.09.06 allows remote unauthenticated attackers to inject malicious scripts into web pages rendered in victims' browsers, enabling session hijacking, credential theft, or unauthorized ERP actions performed on behalf of the victim. The CVSS scope change (S:C) confirms the injected script escapes the OFBiz application context and executes in the victim's browser security domain. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS sits at 0.03% (8th percentile), and no public exploit code is referenced; however, a vendor-released patch to version 24.09.06 is available and should be applied.
Improper Access Control in Apache OFBiz multi-tenant deployments exposes confidential data across tenant boundaries to unauthenticated remote attackers via a network-accessible flaw (AV:N/PR:N). All versions prior to 24.09.06 are affected, limited to multi-tenant configurations. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 4th percentile indicates very low observed exploitation interest at time of analysis, though the attack is automatable per SSVC assessment.
Improper authentication in Apache OFBiz before version 24.09.06 permits unauthenticated remote attackers to bypass authentication controls and access limited confidential information without valid credentials. The flaw (CWE-287) is exploitable over the network with no privilege or user interaction requirements, affecting all OFBiz deployments on unpatched versions. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.02%; however, SSVC marks the attack path as automatable, making it a viable candidate for opportunistic scanning campaigns.
Expression Language Injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject and evaluate EL expressions through unsanitized application inputs, yielding partial confidentiality and integrity impact on the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is network-reachable with no authentication or user interaction, and SSVC classifies the attack as automatable - a meaningful signal given OFBiz's historical exposure to EL-class vulnerabilities. However, real-world urgency is moderated by a very low EPSS score (0.03%, 8th percentile), no public exploit code identified, and no active exploitation reported; vendor patch 24.09.06 is available.
Cross-site scripting, path traversal, and code injection vulnerabilities in Apache OFBiz before version 24.09.06 expose unauthenticated network attackers to the ability to inject malicious scripts into web pages rendered by authenticated users, with the scope change (S:C) in the CVSS vector indicating cross-origin impact such as session hijacking. The co-presence of path traversal and code injection primitives alongside XSS suggests potential for chained exploitation beyond a standard reflected XSS attack, though SSVC rates current exploitation as none and EPSS sits at 0.03% (9th percentile), indicating very low real-world exploitation probability at time of analysis. No public exploit code and no active exploitation (KEV) have been identified; vendor-released patch 24.09.06 is available.
Improper input validation in Apache OFBiz before 24.09.06 allows unauthenticated remote attackers to achieve partial confidentiality and integrity impact over the network with no attack complexity or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). SSVC analysis classifies the flaw as automatable with partial technical impact, meaning it is feasible for automated tools to probe and potentially exploit at scale. No active exploitation has been confirmed - EPSS stands at just 0.04% (11th percentile) and the vulnerability is absent from CISA KEV - indicating current real-world exploitation is unlikely despite the broadly accessible attack surface.
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Customer security group to inject malicious FreeMarker (FTL) template expressions via Data Resource records, yielding partial information disclosure and content integrity impact. The root cause is that the platform's Ecommerce Customer role carried content management grants by default, exposing the FTL template rendering engine to insufficiently trusted input. No public exploit has been identified at time of analysis and EPSS probability is very low (0.02%, 7th percentile), though SSVC flags the attack path as automatable once an account is obtained.
Path traversal in Apache OFBiz before 24.09.06 exposes unauthenticated remote attackers to file read and limited file write capabilities outside the application's intended directory boundaries. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication, no user interaction, and no special network position against any internet-exposed OFBiz instance. No public exploit has been identified at time of analysis and EPSS sits at 0.02% (6th percentile), but SSVC flags the attack as automatable - meaning if tooling emerges, mass internet scanning becomes feasible.