Apache OFBiz Forced Browsing Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-02-04
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

CISA: Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Feb 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• issues.apache.org/jira/browse/OFBIZ-13130Issue TrackingVendor Advisory
• lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wyVendor Advisory
• ofbiz.apache.org/download.htmlProduct
• ofbiz.apache.org/security.htmlVendor Advisory
• www.openwall.com/lists/oss-security/2024/09/03/6Mailing List
• www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource