CVE-2024-45195

9.8

CRITICAL

Apache OFBiz Forced Browsing Vulnerability - [Actively Exploited]

Description

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

INFO

Published Date :

Sept. 4, 2024, 9:15 a.m.

Last Modified :

Feb. 5, 2025, 2 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Feb 25, 2025 | 3 days left

Alert Date: Feb 04, 2025 | 17 days ago

Description :

Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://ofbiz.apache.org/security.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-45195

Public PoC/Exploit Available at Github

CVE-2024-45195 has a 12 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-45195 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Apache	ofbiz

: Total Affected Vendor : 1 | Products : 1

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-45195.

URL	Resource
https://issues.apache.org/jira/browse/OFBIZ-13130	Issue Tracking Vendor Advisory
https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy	Vendor Advisory
https://ofbiz.apache.org/download.html	Product
https://ofbiz.apache.org/security.html	Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/03/6

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

plbplbp/loudong001

搭建漏洞

HTML

Updated: 3 months ago

0 stars 0 fork 0 watcher

Born at : Nov. 20, 2024, 7:53 a.m. This repo has been linked 32 different CVEs too.

XiaomingX/awesome-poc-for-red-team

A curated collection of Proof of Concept (PoC) tools, scripts, and techniques designed for red team operations, penetration testing, and cybersecurity research. This repository focuses on providing practical resources for exploring vulnerabilities

attack cybersecurity exp hw penetration-testing poc red-team security-tools vulnerability-poc

Updated: 4 weeks, 2 days ago

5 stars 2 fork 2 watcher

Born at : Nov. 17, 2024, 11:53 a.m. This repo has been linked 414 different CVEs too.

J1ezds/Vulnerability-Wiki-page

这是一个每天同步Vulnerability-Wiki中docs-base中内容的项目

HTML

Updated: 1 month, 1 week ago

1 stars 0 fork 0 watcher

Born at : Sept. 20, 2024, 3:27 a.m. This repo has been linked 214 different CVEs too.

admin772/POC

None

Updated: 5 months, 1 week ago

0 stars 0 fork 0 watcher

Born at : Sept. 9, 2024, 1:28 a.m. This repo has been linked 128 different CVEs too.

WhosGa/MyWiki

None

HTML

Updated: 1 month, 1 week ago

3 stars 2 fork 2 watcher

Born at : Sept. 4, 2024, 9:24 a.m. This repo has been linked 128 different CVEs too.

wy876/wiki

漏洞文库 wiki.wy876.cn

poc

HTML

Updated: 2 weeks, 3 days ago

507 stars 101 fork 101 watcher

Born at : Dec. 31, 2023, 7:18 a.m. This repo has been linked 43 different CVEs too.

wy876/POC

收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了1400多个poc/exp，长期更新。

poc

Updated: 2 weeks, 2 days ago

4786 stars 997 fork 997 watcher

Born at : Aug. 19, 2023, 12:08 p.m. This repo has been linked 169 different CVEs too.

Threekiii/CVE

一个CVE漏洞预警知识库 no exp/poc

Updated: 1 month, 1 week ago

95 stars 13 fork 13 watcher

Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 143 different CVEs too.

CP04042K/CVE

None

Updated: 5 months, 1 week ago

0 stars 0 fork 0 watcher

Born at : March 3, 2022, 2:23 p.m. This repo has been linked 9 different CVEs too.

Threekiii/Awesome-POC

一个漏洞POC知识库目前数量 1000+

poc

Updated: 2 weeks, 2 days ago

3816 stars 755 fork 755 watcher

Born at : Feb. 20, 2022, 6:43 a.m. This repo has been linked 418 different CVEs too.

Mr-xn/Penetration_Testing_POC

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

penetration-testing poc getshell csrf penetration-testing-poc csrf-webshell cve rce sql-poc poc-exp bypass oa-getshell cve-cms php-bypass thinkphp sql-getshell authentication-bypass cobalt-strike exploit

Python Ruby Makefile C C++ Shell HTML Java Assembly PHP

Updated: 2 weeks, 3 days ago

6703 stars 1844 fork 1844 watcher

Born at : July 24, 2019, 3:37 a.m. This repo has been linked 338 different CVEs too.

tanjiti/sec_profile

爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)

Python HTML

Updated: 2 weeks, 2 days ago

1225 stars 211 fork 211 watcher

Born at : Feb. 19, 2019, 10:24 a.m. This repo has been linked 11 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-45195 vulnerability anywhere in the article.

The Register

DeepSeek's iOS app is a security nightmare, and that's before you consider its TikTok links

Infosec In Brief DeepSeek’s iOS app is a security nightmare that you should delete ASAP, according to researchers at mobile app infosec platform vendor NowSecure. The org have assessed the security of ...

Published Date: Feb 10, 2025 (1 week, 4 days ago)

CVE-2025-0994 CVE-2024-45195 CVE-2024-21413 CVE-2020-29574 CVE-2020-15069 CVE-2018-19410

BleepingComputer

CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks

The US Cybersecurity & Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies and large organizations to apply the ...