CVE-2024-38856—Apache OFBiz Incorrect Authorization Vulnerability

漏洞名称

Apache OFBiz Incorrect Authorization Vulnerability

描述

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

其他说明

• This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w
• https://nvd.nist.gov/vuln/detail/CVE-2024-38856

相关新闻文章

• Apache OFBiz team patches critical RCE vulnerability (CVE-2024-45195)September 6, 2024
• Apache OFBiz Update Fixes High-Severity Flaw Leading to Remote Code ExecutionSeptember 6, 2024
• Apache fixes critical OFBiz remote code execution vulnerabilitySeptember 5, 2024
• CISA Flags Critical Apache OFBiz Flaw Amid Active Exploitation ReportsAugust 28, 2024
• CISA warns about actively exploited Apache OFBiz RCE flawAugust 8, 2024

相关 CWE

• CWE-863