VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 03:02 UTC

CVE-2024-38856

Read full description

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

CVSS 8.1 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.7/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.1: +1.21
Fresh EPSS: 99.43%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Cyber Press

Press · 21 May 2026, 07:00 · Apache OFBiz Flaw Exploited for Auth Bypass and RCE Attacks - Cyber Press

Cyfirma

Press · 24 Sep 2024, 07:00 · CVE 2024-38856 – Pre-authentication Remote Code Execution (RCE) - Vulnerability Analysis and Exploitation - Cyfirma

SecurityWeek

Press · 06 Sep 2024, 07:00 · Apache Makes Another Attempt at Patching Exploited RCE in OFBiz - SecurityWeek

Help Net Security

Press · 06 Sep 2024, 07:00 · Apache OFBiz team patches critical RCE vulnerability (CVE-2024-45195) - Help Net Security

Security Affairs

Press · 06 Sep 2024, 07:00 · Apache fixed a new remote code execution flaw in Apache OFBiz - Security Affairs

See all 11 source documents

BleepingComputer

Press · 05 Sep 2024, 07:00 · Apache fixes critical OFBiz remote code execution vulnerability - BleepingComputer

Rapid7

Press · 05 Sep 2024, 07:00 · CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed) - Rapid7

Dark Reading

Press · 29 Aug 2024, 19:25 · Exploited: CISA Highlights Apache OFBiz Flaw After PoC Emerges - Dark Reading

The Hacker News

Press · 06 Aug 2024, 07:00 · New Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution - The Hacker News

SecurityWeek

Press · 05 Aug 2024, 07:00 · Apache OFBiz Users Warned of New and Exploited Vulnerabilities - SecurityWeek

systemtek.co.uk

Press · 22 Feb 2024, 08:00 · Apache OFBiz createRegister Error Message Information Disclosure Vulnerability [CVE-2024-23946] - systemtek.co.uk

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.1; EPSS 99.4%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, low privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:15.790101+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

22 Feb 2024, 08:00

Published

05 Aug 2024, 08:20

Added to the CISA KEV catalog

27 Aug 2024, 00:00

Latest press mention

21 May 2026, 07:00

Score calculated

05 Nov 2026, 13:59