Russian Vulnerability Scanner Database

Back to List

CVE-2024-38856

Scores

EPSS

0.943high94.3%
0%20%40%60%80%100%

Percentile: 94.3%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don’t explicitly check user’s permissions because they rely on the configuration of their endpoints).

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

anchore_overridesnvd

CWEs

CWE-863

Related Vulnerabilities

BDU:2024-05995

Exploits

Exploit ID: CVE-2024-38856

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Vulnerable Software (2)

Type: Configuration

Operating System:

Trait: 
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*",          "versionEndExcluding": "18.12.15"        }      ],      "negate": fa...

Source: anchore_overrides

Type: Configuration

Vendor: apache

Product: ofbiz

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*",      "versionEndExcluding": "18.12.15",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd