CVE-2024-45195

Apache OFBiz, the open-source ERP and e-commerce framework from the Apache Software Foundation, is affected by a forced browsing vulnerability (CWE-425), meaning the application fails to properly verify a requester's authorization for certain restricted resources. A remote attacker triggers the flaw by directly requesting protected URLs or endpoints (navigating straight to them rather than through the intended application flow), thereby bypassing access-control checks. Successful exploitation grants the attacker unauthorized access to the affected OFBiz instance, as described by CISA; the available data does not detail what specific functionality or data is exposed. Any organization running Apache OFBiz, particularly internet-facing deployments, is affected, though no specific version range is listed in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-02-04, indicating confirmed exploitation in the wild, and EPSS assigns it an approximately 100% probability of exploitation within 30 days (top percentile); no public proof-of-concept is known.

What to do: Apply the mitigations specified in CISA's required action and per Apache's advisory, or discontinue use of the product if mitigations are unavailable; upgrade to the fixed OFBiz release identified in the vendor advisory. Check OFBiz access logs for direct, unauthenticated requests to restricted URLs, especially around and after the 2025-02-04 KEV listing, and restrict internet exposure of OFBiz front-ends and administrative screens.