Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-45195: Apache OFBiz lets attackers view restricted pages
CVE-2024-45195 · published 2 years ago · actively exploited
Summary
Apache OFBiz can be tricked into showing pages that should be hidden from users. This means someone outside your network could see data or functions they shouldn't have access to. Apply the latest security update from Apache or restrict access to the application until it is patched.
What to do
- Update apache ofbiz to version 18.12.16 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache | ofbiz | < 18.12.16 |
Original advisory text
Apache OFBiz Forced Browsing Vulnerability
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
References
- https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/09/03/6 URL
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-... URL
- https://ofbiz.apache.org/download.html Vendor Advisory
- https://ofbiz.apache.org/security.html Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45195... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45195 Vendor Advisory
- https://issues.apache.org/jira/browse/OFBIZ-13130 Third Party Advisory
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
>99%
chance of attack within 30 days
Type
CWE-425Direct Request ('Forced Browsing')
Timeline
Published4 Sep 2024
Updated28 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta