CVE-2024-38856

ENISA EUVD: EUVD-2024-37643 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 20, 2026 2 articles Published: 2024-08-05
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23
94.38%
probability
This CVE has a 94.38% probability of being exploited in the next 30 days.
0% Top 100.0th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
8.1
HIGH
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

VulnerabilityLookup (CNA)
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Affected Products

Apache Software Foundation
Apache OFBiz
0

Attack Intelligence

Exploits & PoC

securelayer7/CVE-2024-38856_Scanner

Apache OFBiz RCE Scanner & Exploit (CVE-2024-38856)

50 2024-10-02
0x20c/CVE-2024-38856-EXP

CVE-2024-38856 Exploit

9 2024-08-22
BBD-YZZ/CVE-2024-38856-RCE

Apache OFBiz CVE-2024-38856

3 2024-08-28
Hex00-0x4/CVE-2024-38856-Apache-OFBiz

CVE-2024-38856: Apache OFBiz remote code execution Scanner & Exploit

3 2025-10-10
Ap0dexMe0/CVE-2024-38856

Perform With Massive Apache OFBiz Zero-Day Scanner & RCE

2 2024-08-10
Praison001/CVE-2024-38856-ApacheOfBiz

Exploit for CVE-2024-38856 affecting Apache OFBiz versions before 18.12.15

1 2024-08-18
emanueldosreis/CVE-2024-38856

Nuclei template to scan for Apache Ofbiz affecting versions before 18.12.15

1 2024-08-28
AlissonFaoli/Apache-OFBiz-Exploit

Exploit for Apache OFBiz - CVE-2024-38856

1 2025-03-23
8 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
92%
EPSS 94.38%
CVSS v3.1 8.1
Mentions 2

CNA Information

CNA Assigner
apache
CNA Title
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Analyst Note

CVE-2024-38856 is explicitly labeled a 'zero-day' in authoritative sources (TheHackerNews) with documented active exploitation in the wild. CISA KEV listing confirms active exploitation. Apache OFBiz RCE flaw meets zero-day criteria: pre-authentication RCE in widely-deployed ERP software exploited before or concurrent with patch availability.

Triage Info

Decided atMar 20, 2026
Published DateAug 05, 2024