# CVE-2024-38856: Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

> CVE-2024-38856: Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code. CVSS 8.1 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2024-38856
Last updated: 2025-10-21T22:55:48Z

- Published: 2024-08-05 08:20 UTC · Updated: 2025-10-21 22:55 UTC · Assigner: apache
- CVSS: 8.1 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS: 99.4%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2024-08-27, federal due date 2024-09-17, ransomware use: Unknown
- CWE: CWE-863

## Description

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

## CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

## Affected vendors and products

- apache: ofbiz
- Apache Software Foundation: Apache OFBiz

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2024-38856)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2024-38856)
- [https://issues.apache.org/jira/browse/OFBIZ-13128](https://issues.apache.org/jira/browse/OFBIZ-13128)
- [https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w](https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w)
- [https://ofbiz.apache.org/download.html](https://ofbiz.apache.org/download.html)
- [https://ofbiz.apache.org/security.html](https://ofbiz.apache.org/security.html)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2024-38856 · Markdown: https://rewindex.com/cve/CVE-2024-38856.md · JSON: https://rewindex.com/api/v1/cves/CVE-2024-38856 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:19.162Z