CVE-2024-45195
published 2024-09-04CVE-2024-45195: Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version…
PriorityP190high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-02-25
Exploited in the wild
EPSS
99.98%
100.0th percentile
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | < 18.12.16 | 18.12.16 |
| apache | ofbiz | — | — |
| apache_software_foundation | apache_ofbiz | < 18.12.16 | 18.12.16 |
Detection & IOCsextracted from sources · hover to see the quote
urlPOST /webtools/control/forgotPassword/xmldsdump HTTP/1.1
path/webtools/control/forgotPassword/xmldsdump
path/common/{{filename}}.txt
cookieofbiz.visitor=
commandoutpath=./themes/common-theme/webapp/common-theme/&maxrecords=&filename={{filename}}.txt&entityFrom_i18n=&entityFrom=&entityThru_i18n=&entityThru=&entitySyncId=&preConfiguredSetName=&entityName=UserLogin&entityName=CreditCard
- →Exploit targets the /webtools/control/forgotPassword/xmldsdump endpoint via unauthenticated POST request, exploiting missing view authorization checks (forced browsing / CWE-425).
- →Successful exploitation results in a .txt file written under /common/ containing XML entity-engine output; detect responses containing both '<?xml version=' and 'entity-engine-xml' with content-type text/plain.
- →CVE-2024-45195 is a patch bypass for CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856; all share the same root cause (controller-view map fragmentation). Detections for those CVEs may also fire on this one. ↗
- →Check Point IPS blade signature name for this CVE can be used as a detection reference: 'Apache OFBiz Remote Code Execution (CVE-2024-45195)'. ↗
- →Shodan query 'ofbiz.visitor=' can be used to identify exposed Apache OFBiz instances for asset discovery and attack surface monitoring.
- →The exploit POST body targets entityName=UserLogin and entityName=CreditCard, indicating data exfiltration of credential and payment data via the xmldsdump view.
- ·The vulnerability only affects Apache OFBiz versions before 18.12.16; instances running 18.12.16 or later with commits ab78769c2d and 8b95fe6fa applied are not vulnerable. ↗
- ·The root cause is missing view authorization checks (controller-view map fragmentation), not a specific configuration option; the fix adds authorization checks server-side and cannot be mitigated purely through configuration. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
cisa7.5HIGH
vendor_apache7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache OFBiz Forced Browsing Vulnerability
cisa·2025-02-04·CVSS 7.5
CVE-2024-45195 [HIGH] CWE-425 Apache OFBiz Forced Browsing Vulnerability
Vulnerability: Apache OFBiz Forced Browsing Vulnerability
Affected: Apache OFBiz
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://ofbiz.apache.org/security.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-45195
Remediation Due Date: 2025-02-25
Apache
Apache ofbiz: CVE-2024-45195
vendor_apache·CVSS 7.5
CVE-2024-45195 [HIGH] Apache ofbiz: CVE-2024-45195
Apache ofbiz: CVE-2024-45195
; affected releases before 18.12.16; fixed in 18.12.16 with commits ab78769c2d , 8b95fe6fa
GHSA
GHSA-hrmf-4pvg-rf3x: Direct Request ('Forced Browsing') vulnerability in Apache OFBiz
ghsa_unreviewed·2024-09-04
CVE-2024-45195 [HIGH] CWE-425 GHSA-hrmf-4pvg-rf3x: Direct Request ('Forced Browsing') vulnerability in Apache OFBiz
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
VulnCheck
Apache OFBiz Forced Browsing Vulnerability
vulncheck·2024·CVSS 7.5
CVE-2024-45195 [HIGH] CWE-425 Apache OFBiz Forced Browsing Vulnerability
Apache OFBiz Forced Browsing Vulnerability
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
Affected: Apache OFBiz
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.imperva.com/blog/imperva-protects-against-critical-apache-ofbiz-vulnerability/; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-05&host_type=src&vulnerability=cve-2024-45195; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-11&host_type=src&vulnerability=cve-2024-45195; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-12&host_type=src&vuln
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Server-Side Request Forgery (CVE-2024-45195)
suricata·2024-10-01·CVSS 7.5
CVE-2024-45195 [HIGH] ET WEB_SPECIFIC_APPS Apache OFBiz Server-Side Request Forgery (CVE-2024-45195)
ET WEB_SPECIFIC_APPS Apache OFBiz Server-Side Request Forgery (CVE-2024-45195)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Server-Side Request Forgery (CVE-2024-45195)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webtools/control/forgotPassword/viewdatafile"; fast_pattern; http.request_body; content:"DATAFILE_LOCATION|3d|"; pcre:"/^(?:ht|f)tps?\x3a\x2f{2}/Ri"; content:"DATAFILE_IS_URL|3d|true"; content:"DEFINITION_LOCATION|3d|"; pcre:"/^(?:ht|f)tps?\x3a\x2f{2}/Ri"; content:"DEFINITION_IS_URL|3d|true"; reference:url,www.rapid7.com/blog/post/2024/09/05/cve-2024-45195-apache-ofbiz-unauthenticated-remote-code-execution-fixed/; reference:cve,2024-45195; classtype:web-application-attack; sid:2056365; rev:1; metadata:affecte
Nuclei
Apache OFBiz - Remote Code Execution
nuclei·CVSS 7.5
CVE-2024-45195 [HIGH] Apache OFBiz - Remote Code Execution
Apache OFBiz - Remote Code Execution
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server
Template:
id: CVE-2024-45195
info:
name: Apache OFBiz - Remote Code Execution
author: DhiyaneshDK
severity: high
description: |
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server
impact: |
Unauthenticated attackers can exploit missing view authorization checks to execute arbitrary code on Apache OFBiz ser
Bleepingcomputer
CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
blogs_bleepingcomputer·2025-02-05·CVSS 7.5
[HIGH] CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
## CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
## Bill Toulas
The US Cybersecurity & Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies and large organizations to apply the available security updates as soon as possible.
Among them are flaws impacting Microsoft .NET Framework and Apache OFBiz (Open For Business), two widely used software applications.
Though the agency has marked those flaws as actively exploited in attacks, it has not provided specific details about the malicious activity, who is conducting it, and against whom.
The first flaw, tracked under CVE-2024-29059 , is a high severity (CVSS v3 score: 7.5) information disclosure bug in the .NET Framework discov
Checkpoint
9th September – Threat Intelligence Report
blogs_checkpoint·2024-09-09
CVE-2024-32896 9th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 9th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 9th September, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The German air traffic control agency, Deutsche Flugsicherung, has confirmed a cyberattack that impacted its administrative IT infrastructure. The extent of data accessed is still under investigation, and flight operations remained unaffected. No threat actor has claimed responsibility yet, though the attack is suspecte
Bleepingcomputer
Apache fixes critical OFBiz remote code execution vulnerability
blogs_bleepingcomputer·2024-09-05·CVSS 9.8
[CRITICAL] Apache fixes critical OFBiz remote code execution vulnerability
## Apache fixes critical OFBiz remote code execution vulnerability
## Sergiu Gatlan
Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.
OFBiz is a suite of customer relationship management (CRM) and enterprise resource planning (ERP) business applications that can also be used as a Java-based web framework for developing web applications.
Tracked as CVE-2024-45195 and discovered by Rapid7 security researchers, this remote code execution flaw is caused by a forced browsing weakness that exposes restricted paths to unauthenticated direct request attacks.
"An attacker with no valid credentials can exploit missing view authorization checks in
Greynoiseio
NoiseLetter October 2024
blogs_greynoiseio
NoiseLetter October 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
Towards Improving IDS Using CTF Events
arxiv_fulltext·2025-01-20
Towards Improving IDS Using CTF Events
Towards Improving Intrusion Detection Systems Using Capture the Flag Events
Towards Improving IDS Using CTF Events
Manuel Kern1 Florian Skopik1 Max Landauer1 Edgar Weippl2
M. Kern et al.
Austrian Institute of Technology, Giefinggasse 4 1210 Vienna
University of Vienna, Universitaetsring 1, 1010 Vienna
## Abstract
In cybersecurity, Intrusion Detection Systems (IDS) serve as a vital defensive layer against adversarial threats. Accurate benchmarking is critical to evaluate and improve IDS effectiveness, yet traditional methodologies face limitations due to their reliance on previously known attack signatures and lack of creativity of automated tests. This paper introduces a novel approach to evaluating IDS through Capture the Flag (CTF) events, specifically designed to uncover weaknesse
https://issues.apache.org/jira/browse/OFBIZ-13130https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wyhttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/security.htmlhttp://www.openwall.com/lists/oss-security/2024/09/03/6https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195
2024-09-04
Published
2025-02-04
Added to CISA KEV
Exploited in the wild