CVE-2024-45195: Apache OFBiz forced-browsing patch bypass to remote code execution, actively exploited
The short version: Apache OFBiz has a forced-browsing flaw (CVE-2024-45195) that lets an unauthenticated attacker reach restricted views directly, bypassing the fixes for several earlier OFBiz bugs. On paper NVD calls it a 7.5 information-exposure issue — in the real world it shares a root cause with prior remote-code-execution flaws and landed in CISA's KEV catalog. Patch to 18.12.16. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~99.98% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-02-25 |
| Known exploited? | Yes — CISA-listed as exploited; bypasses prior OFBiz patches |
| Vulnerability type | CWE-425 direct request / forced browsing → restricted-view access → code execution in practice |
| Requires authenticated session? | No — pre-authentication |
| Affected | Apache OFBiz before 18.12.16 |
| Fixed in | Apache OFBiz 18.12.16 |
What you need to know
Apache OFBiz is a business platform — ERP, e-commerce, CRM. CVE-2024-45195 is a forced-browsing flaw: an unauthenticated attacker requests a restricted view directly and reaches functionality that authorization checks were supposed to gate. Critically, it shares the same underlying cause — controller-view map fragmentation — as a run of earlier OFBiz vulnerabilities, and it bypasses the patches issued for them.
This is a clean example of practical severity outrunning the base score:
- NVD scores it 7.5, treating it as an information-exposure issue (confidentiality only).
- The real world put it in KEV. Because it reopens the same paths that led to code execution in prior OFBiz CVEs, it's exploited as a route to RCE, not just data disclosure — which is why CISA lists it as actively exploited.
- It's a patch bypass. Organizations that fixed the earlier bugs were not necessarily safe from this one.
How serious we see it
High — in practice, not on paper.
The 7.5 captures the mechanical view (an unauthenticated read of restricted content), but it undersells what this flaw does in a real OFBiz deployment: it bypasses prior fixes to reach the same functionality that yields code execution, and it's confirmed exploited in the wild. We rate it by impact and by KEV status, not by the metric box the base score lands in. The reassuring part: 18.12.16 closes it, and exposure is quick to determine.
Recommendations
Straight from the Apache OFBiz security advisory and CISA:
- Patch now. Upgrade to Apache OFBiz 18.12.16 or later — earlier patches do not cover this bypass.
- Restrict access. Limit the OFBiz application to trusted networks until you've patched.
- Hunt for prior use. Review application logs for direct requests to restricted views and unauthenticated endpoints.
- If you find indicators, respond. Rotate credentials and secrets reachable from the server and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run an internet-facing OFBiz instance below 18.12.16 — even if you patched earlier OFBiz CVEs.
How BreachRisk sees it
BreachRisk discovers internet-facing OFBiz instances from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because our severity take reflects the real-world impact, not just the 7.5.
That continuous, attacker's-eye view earns its keep on flaws exactly like this, where the CVSS band undersells the danger: you see the exposed OFBiz server ranked by how it actually gets used against you.