CVEvulnerability

CVE-2024-45195

7.5 HIGH Known exploited Published 2024-09-04 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Apache OFBiz Forced Browsing Vulnerability — Apache OFBiz

Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

Added to KEV
2025-02-04
Remediation due
2025-02-25
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://ofbiz.apache.org/security.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-45195
Status
Analyzed
Published
2024-09-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-425

Description

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Affected configurations

• apache ofbiz (< 18.12.16)

Related

Weakness · CWE (1)

References