CVE-2024-45507: Apache OFBiz unauthenticated remote code execution
The short version: Apache OFBiz — the open-source ERP suite — has a flaw (CVE-2024-45507) where missing view-authorization checks let an unauthenticated attacker reach code injection and server-side request forgery, leading to remote code execution. There's no login required. It isn't in CISA's KEV catalog yet, but the base score is 9.8 and exploit interest is high. Patch to 18.12.16. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, though not (yet) KEV-listed |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~93.24% · 99.82th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in KEV; high exploit interest and public tooling |
| Vulnerability type | CWE-94 code injection + CWE-918 SSRF → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Apache OFBiz before 18.12.16 |
| Fixed in | Apache OFBiz 18.12.16 |
What you need to know
Apache OFBiz is a business platform — ERP, e-commerce, CRM — so a foothold in it reaches sensitive data and internal processes. CVE-2024-45507 stems from missing authorization checks in the web application: an unauthenticated attacker can invoke functionality they shouldn't reach, combining code injection with server-side request forgery to execute code on the server.
Why to prioritize it:
- It's pre-authentication. No valid credentials are needed, and OFBiz web endpoints are often internet-facing.
- The target is an ERP. Remote code execution here isn't one host — it's the platform that runs orders, inventory, and finance.
- Exploit interest is high. OFBiz has been a repeated target across a series of related authorization bypasses, so tooling and attention already exist.
How serious we see it
High — a critical-class bug we rate by the whole picture.
Mechanically it's a 9.8: unauthenticated, network-reachable code execution. We call it High rather than Critical for one honest reason — it isn't in CISA's KEV catalog, so we're not asserting confirmed mass exploitation the way we would for a KEV item. That said, the impact is severe and the fix is unambiguous, so this belongs near the top of the queue. The reassuring part: one upgrade closes it, and exposure is quick to determine.
Recommendations
Straight from the Apache OFBiz security advisory:
- Patch now. Upgrade to Apache OFBiz 18.12.16 or later.
- Restrict access. Limit the OFBiz application to trusted networks until you've patched.
- Hunt for prior use. Review application logs for anomalous requests to unauthenticated endpoints.
- If you find indicators, respond. Rotate credentials and secrets reachable from the server and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run an internet-facing OFBiz instance below 18.12.16.
How BreachRisk sees it
BreachRisk discovers internet-facing OFBiz instances from little more than your domain, fingerprints the version, and flags exposure tied to this CVE. Even before a flaw lands in KEV, an unauthenticated RCE in a business platform is the kind of finding that should rise in your results — and BreachRisk ranks it that way.
That continuous, outside-in view means an exposed OFBiz server is already mapped, so you can go straight to patch-and-verify instead of learning about it the hard way.