CVE-2024-45195: Apache OFBiz forced browsing exposes restricted endpoints

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityThe flaw is remotely exploitable without authentication, is listed in CISA KEV as actively exploited, and has an EPSS probability near 1.0.

What it is

Apache OFBiz before 18.12.16 is affected by a direct request (forced browsing) flaw, CWE-425, that lets a remote unauthenticated client reach functionality that should require authentication or authorization. Because OFBiz is a widely deployed ERP and e-commerce platform, unauthenticated access to protected endpoints can expose sensitive data and administrative functions.

Impact

An attacker gains access to protected resources and functionality without authenticating, with high confidentiality impact per the CVSS vector. The record does not state whether integrity or availability can also be affected.

Attack surface

Reachable over the network via HTTP requests to the OFBiz web application, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not identify the specific URL paths or endpoints involved.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-02-04, indicating active exploitation, and EPSS gives a 30-day probability of 0.99983 (99.98th percentile). No ransomware campaign use is documented in the record.

What to do

• Upgrade Apache OFBiz to version 18.12.16 or later, which the vendor states fixes the issue.
• If immediate upgrade is not possible, follow the vendor guidance in the Apache security advisory and CISA required action, or discontinue use of the product.
• Restrict network access to OFBiz web interfaces so only trusted networks or users can reach them.
• Review and enforce authorization checks on OFBiz endpoints, especially any reachable without authentication.
• Monitor for exploitation attempts against internet-exposed OFBiz instances until patched.

Detection

• Review OFBiz access logs for direct requests to protected or administrative paths that return success without a prior authentication event.
• Alert on requests to OFBiz endpoints from unauthenticated sessions that would normally require login.
• Correlate OFBiz web logs with CISA KEV timelines and known scanning activity against the product.
• Audit exposed OFBiz instances for version below 18.12.16.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.