VulnSocial

CVE-2024-45195Disclosure(apache / ofbiz)

LOWCVSS 7.5 · HIGHCISA KEV

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

apache CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-02-25. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-425

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ofbiz

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-03-04); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
apache
Products
ofbiz

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-03-04: 1Mentions · 2026-03-31: 1Mentions · 2026-07-12: 1PoC Mentioned / Linked · 2026-03-04: 1PoC Mentioned / Linked · 2026-07-12: 1Technical Details · 2026-03-04: 1Technical Details · 2026-03-31: 1Technical Details · 2026-07-12: 103-0403-3107-12
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-041
Disclosure1
2026-03-311
General1
2026-07-121
Disclosure1
Full discourse3 posts
  • r0otk3r@r0otk3r
    Disclosure

    🚨CVE-2024-45195: How "Forced Browsing" leads to Unauth RCE in Apache OFBiz. #CVE202445195 #CyberSecurity #CISA #Infosec #BugBounty #RCE #Pentesting #ApacheOFBiz https://t.co/0gBbxndcId

    Post summary

    The tweet announces CVE-2024-45195, describing a forced browsing flaw that enables unauthenticated remote code execution in Apache OFBiz, and links to additional details.

    01010126
    41 followersView on X
  • r0otk3r@r0otk3r
    Disclosure

    🚨 CVE-2024-45195: Critical 9.8 CVSS Apache OFBiz Unauthenticated Remote Code Execution https://www.youtube.com/watch?v=aKhJcDOTcpc #Cybersecurity #Infosec #AppSec #RCE #Apache #OFBiz #Java #AuthBypass #CVE202445195 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/Q9oZBs8H5k

    Post summary

    The tweet announces CVE‑2024‑45195, a critical RCE flaw in Apache OFBiz, offers a PoC video link, and urges users to patch without indicating active exploitation or a mitigation voucher.

    0001057
    43 followersView on X
  • Patrick Roland@DeusLogica
    General

    🔴 EPSS 94.0% | Almost certainly exploitation | medium confidence CVE-2024-45195 (EPSS 94.00%) Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. Affects versions before 18.12.16. Highest risk of all CVEs by exploitation likelihood Source: http://FIRST.org EPSS | Reliability: B Link: https://nvd.nist.gov/vuln/detail/CVE-2024-45195 #EPSS #threatintel #CVE #cybersecurity

    Post summary

    The message highlights an EPSS‑rated high exploitation risk for CVE‑2024‑45195, a forced‑browsing flaw in Apache OFBiz prior to v18.12.16, but gives no PoC, exploit, or patch details.

    1000055
    311 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheofbiz---

Explore more

Back to dashboardapache CVEsofbiz vulnerabilities