CVE-2024-38856

The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reveals the worst-case scenario for exploitability. Attack Vector (Network) means the vulnerability is remotely exploitable over any network connection. Attack Complexity (Low) indicates no special conditions are required. Privileges Required (None) confirms that no authentication whatsoever is needed to exploit the flaw. User Interaction (None) means the attack can be fully automated without any user involvement. Scope (Unchanged) keeps the impact within the OFBiz application context. All three impact categories — Confidentiality, Integrity, and Availability — are rated High.

The technical root cause lies in how Apache OFBiz handles view rendering for unauthenticated endpoints. Certain screen definitions in OFBiz do not explicitly enforce permission checks because they were designed under the assumption that the view configuration layer would handle access control. However, an attacker can craft requests that bypass the view layer's authorization logic and directly invoke screen rendering code. When specific preconditions are met — such as targeting screens that rely on implicit rather than explicit permission checks — the attacker gains the ability to execute rendering operations that expose application data and functionality. This effectively transforms what should be restricted administrative or user-level operations into publicly accessible endpoints. The vulnerability is straightforward to exploit, requiring only crafted HTTP requests to the OFBiz instance.