CVE-2024-45195
Apache OFBiz Forced Browsing Vulnerability
Description
CVE-2024-45195 is a high-severity forced browsing vulnerability in Apache OFBiz before version 18.12.16 that allows a remote unauthenticated attacker to access restricted resources and obtain sensitive information. With a CVSS v3.1 base score of 7.5, the flaw enables direct request access to endpoints that should require authentication, bypassing the application's access control mechanisms entirely. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 25, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 94.15% at the 99.9th percentile indicates near-certain exploitation probability, confirming that this is among the most actively targeted vulnerabilities in the entire tracked landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | ofbiz | < 18.12.16 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://issues.apache.org/jira/browse/OFBIZ-13130(Issue Tracking, Vendor Advisory)
- https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy(Vendor Advisory)
- https://ofbiz.apache.org/download.html(Product)
- https://ofbiz.apache.org/security.html(Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2024/09/03/6(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195(Third Party Advisory, US Government Resource)
Weakness Type
Unknown CWE
CVE-2024-45195 does not have a specific CWE assigned in the NVD database, but the vulnerability is explicitly described as a Direct Request (Forced Browsing) flaw. Forced browsing occurs when a web application does not properly enforce authorization checks on resource access, allowing an attacker to directly request URLs that should be restricted to authenticated or authorized users. In Apache OFBiz, certain application views and controller endpoints can be accessed by unauthenticated users through direct URL manipulation, bypassing the intended authentication and authorization workflow. This allows attackers to reach administrative functions, view sensitive business data, or interact with internal APIs without ever authenticating. Forced browsing is particularly dangerous in enterprise resource planning (ERP) systems like OFBiz because these applications typically manage highly sensitive financial, customer, and operational data. Learn more about Forced Browsing
Impact Analysis
The impact of CVE-2024-45195 is focused primarily on confidentiality, which is rated as high, while integrity and availability are not directly affected by the forced browsing itself. Confidentiality is severely compromised because the forced browsing vulnerability allows unauthenticated attackers to access restricted views and data within the OFBiz application. Apache OFBiz is an enterprise resource planning and e-commerce platform that typically contains highly sensitive business data including customer records, financial transactions, inventory data, supplier information, and internal business processes.
While integrity and availability receive no direct impact rating from the forced browsing vulnerability itself, the exposed information and accessible endpoints can serve as a foundation for more destructive attacks. Access to internal application views may reveal additional attack surface, configuration details, or business logic that facilitates further exploitation. The EPSS score of 94.15% at the 99.9th percentile confirms this vulnerability is being exploited at the highest observed rates. The combination of network accessibility, no authentication requirement, no user interaction, and low attack complexity makes mass exploitation trivially feasible. Apache OFBiz has been repeatedly targeted by threat actors, and this vulnerability joins a pattern of critical authorization bypass flaws in the platform. Organizations running OFBiz versions prior to 18.12.16 are at immediate risk, particularly if the application is accessible from the internet.
Exploit Maturity
CVE-2024-45195 demonstrates maximum exploit maturity through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 25, 2025. The EPSS score of 94.15% at the 99.9th percentile reflects the highest tier of exploitation activity. The vulnerability was reported through the Apache security process and discussed on the oss-security mailing list, with the Apache OFBiz team tracking the issue as OFBIZ-13130.
Apache OFBiz has been a frequent target for threat actors, with multiple critical authentication bypass vulnerabilities discovered in recent years. CVE-2024-45195 follows a pattern of forced browsing and access control bypass flaws that make OFBiz a high-value target for attackers seeking access to enterprise data. The official security advisory is available on the Apache OFBiz security page. The CISA KEV entry can be reviewed at the KEV catalog. The ransomware association is unknown, but the pattern of repeated critical vulnerabilities in OFBiz combined with the platform's access to sensitive enterprise data makes it an attractive target for attackers conducting data theft, business email compromise, or ransomware operations that begin with reconnaissance of business systems.
Remediation
-
Upgrade Apache OFBiz to version 18.12.16 or later immediately. This version addresses the forced browsing vulnerability by implementing proper authorization checks on all restricted views and controller endpoints. Download the updated version from the official Apache OFBiz download page.
-
Restrict network access to the OFBiz application to trusted networks only. Place OFBiz behind a reverse proxy or web application firewall that limits access to the management interface and internal views. Never expose OFBiz directly to the public internet without robust access controls at the network layer.
-
Review OFBiz access logs for evidence of forced browsing by examining web server logs for direct requests to administrative or restricted URLs from unauthenticated sessions. Look for patterns of sequential URL enumeration or access to internal controller paths that bypass the normal navigation flow.
-
Implement a web application firewall (WAF) with rules that detect and block forced browsing attempts. Configure the WAF to require valid session tokens for access to restricted OFBiz endpoints and to alert on access patterns indicative of automated directory and endpoint discovery.
-
Audit the data accessible through OFBiz to understand the potential impact if the vulnerability was previously exploited. Review customer data, financial records, and business configurations stored in the system. If unauthorized access is suspected, initiate incident response procedures including notification obligations under applicable data protection regulations.
Technical Details
CVE-2024-45195 is a forced browsing (direct request) vulnerability in Apache OFBiz, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability is exploitable over the network. Attack Complexity (AC:L) means exploitation requires no special conditions. Privileges Required (PR:N) confirms no authentication is needed. User Interaction (UI:N) indicates no victim action is required. Scope (S:U) means the impact stays within the OFBiz application context. The impact ratings show Confidentiality (C:H) as the sole affected dimension, consistent with an information disclosure through unauthorized access.
The forced browsing vulnerability exists because Apache OFBiz prior to version 18.12.16 does not consistently enforce authentication and authorization checks for all controller request handlers and view mappings. The OFBiz web framework uses a controller.xml configuration file to define request mappings and their associated authentication requirements. The vulnerability arises from endpoints where the authentication requirement is either missing, misconfigured, or can be bypassed through direct URL construction. An attacker can enumerate and directly access these unprotected endpoints by crafting HTTP requests to specific OFBiz controller paths, gaining access to views that display sensitive application data without first authenticating. The fix in version 18.12.16 adds consistent authorization enforcement across all restricted endpoints, ensuring that direct requests to protected resources are properly validated before granting access.
Frequently Asked Questions
What is CVE-2024-45195?
CVE-2024-45195 is a high-severity forced browsing vulnerability in Apache OFBiz that allows unauthenticated attackers to directly access restricted application endpoints and view sensitive data. It carries a CVSS score of 7.5 and is listed in CISA's KEV catalog.
What is forced browsing and how does it apply to CVE-2024-45195?
Forced browsing is an attack technique where an attacker directly requests URLs that should require authentication, bypassing the normal application navigation flow. In CVE-2024-45195, certain OFBiz controller endpoints lack proper authentication checks, allowing direct unauthenticated access to restricted views.
Which versions of Apache OFBiz are vulnerable to CVE-2024-45195?
All versions of Apache OFBiz prior to version 18.12.16 are affected. Users should upgrade to version 18.12.16 or later to resolve the vulnerability.
Is CVE-2024-45195 being exploited in the wild?
Yes, CVE-2024-45195 is confirmed to be actively exploited. With an EPSS score of 94.15% at the 99.9th percentile, it ranks among the most exploited vulnerabilities globally. CISA has listed it in the KEV catalog with a mandatory remediation deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.