Description
Apache OFBiz存在远程代码执行漏洞。此漏洞是由于应用程序对用户的请求缺乏校验导致的。
Apache OFBiz groovy 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.rapid7.com/blog/post/2024/09/05/cve-2024-45195-apache-ofbiz-unauthenticated-remote-code-execution-fixed/
https://vulncheck.com/blog/ofbiz-cve-2023-51467
https://www.zscaler.com/blogs/security-research/cve-2024-38856-pre-auth-rce-vulnerability-apache-ofbiz
https://www.tenable.com/plugins/nessus/148239
https://www.sentinelone.com/vulnerability-database/cve-2026-45434/
https://ofbiz.apache.org/release-notes-18.12.06.html
https://isc.sans.edu/diary/31132
https://www.broadcom.com/support/security-center/protection-bulletin/protection-highlight-multiple-apache-ofbiz-vulnerabilities-exploited
https://avd.aliyun.com/product?prod=ofbiz
https://zhuanlan.zhihu.com/p/675065187
https://blog.securelayer7.net/cve-2024-38856-apache-ofbiz-rce/
https://cvefeed.io/vuln/detail/CVE-2024-38856
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/framework/Apache-OFBiz-%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81%E7%BB%95%E8%BF%87%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C-CVE-2024-38856.md
https://lists.apache.org/thread/022r19skfofhv3lzql33vowlrvqndh11
https://x.com/HunterMapping/status/1833396602049892740