ACTIEF MISBRUIKT
CVE-2024-38856: Apache OFBiz Incorrect Authorization Vulnerability
| Leverancier | Apache |
|---|---|
| Product | OFBiz |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 27 aug 2024 |
| CISA-deadline (Amerikaanse overheid) | 17 sep 2024 |
| Zwakte (CWE) | CWE-863 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
BRONNEN
Andere lekken bij Apache
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.