CVE-2024-38856 — Apache OFBiz (Repository documentation)

Repository purpose: informational documentation about CVE-2024-38856 (Apache OFBiz incorrect-authorization / pre-auth RCE).
This repository does not contain weaponized exploit code. It is intended for defensive research, patching guidance, detection, and safe lab testing only.

---

Overview

CVE-2024-38856 is an incorrect-authorization vulnerability in Apache OFBiz that may allow unauthenticated access to certain endpoints and, under specific conditions, enable execution of screen rendering code which can lead to remote code execution on affected systems. The issue was fixed in Apache OFBiz 18.12.15; earlier releases up to 18.12.14 are affected. :contentReference[oaicite:0]{index=0}

Severity / Impact: multiple security vendors and researchers rated this vulnerability as critical — it can lead to unauthenticated remote code execution on vulnerable instances, and has been observed in active exploitation attempts in the wild. Administrators should treat exposed OFBiz instances as high-priority remediation items. :contentReference[oaicite:1]{index=1}

---

Affected versions

• Apache OFBiz: through 18.12.14 (i.e., all releases <= 18.12.14 are considered vulnerable). The issue was addressed in 18.12.15. Upgrade is recommended. :contentReference[oaicite:2]{index=2}