Actively exploited in the wild
Apache OFBiz Forced Browsing Vulnerability
Apache - OFBiz · Listed in the CISA KEV since 2025-02-04. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-45195
HighCVSS 7.5KEVSummary
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz before 18.12.16.
Risk Assessment
It may lead to unauthorized access to application functions or data, which in the context of OFBiz (ERP) could mean leakage or modification of business data.
Recommendation
Upgrade Apache OFBiz to version 18.12.16, which fixes this issue.
Other vulnerabilities in Apache OFBiz
See all- CVE-2026-46586High
Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.
- CVE-2026-31910High
The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.
- CVE-2026-31909High
The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.
- CVE-2026-29226High
The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.
- CVE-2016-4462High
CVE-2016-4462 allows a malicious, logged-in user to manipulate the URL parameter externalLoginKey, potentially leading to remote code execution via a specially crafted Freemarker template.
- CVE-2026-45434Critical
CVE-2026-45434 in Apache OFBiz has a flaw in password-change logic that can lead to remote code execution. This issue affects versions before 24.09.06.
- CVE-2026-41919Critical
CVE-2026-41919 describes an improper neutralization of special elements used in LDAP queries, leading to LDAP Injection vulnerability in Apache OFBiz.
- CVE-2026-31986Critical
Use of hard-coded cryptographic key vulnerability in Apache OFBiz. This issue affects versions before 24.09.06.
- CVE-2024-38856CriticalActively exploited
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
- CVE-2024-32113CriticalActively exploited
In Apache OFBiz before 18.12.13, a path traversal vulnerability exists due to improper limitation of a pathname to a restricted directory. Attackers can access files outside the intended directory.
Original NVD description (English source)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.