What is CVE-2024-45507?

CVE-2024-45507 is a vulnerability in Apache Software Foundation Ofbiz, classified under Server-Side Request Forgery (SSRF). Published 2024-09-04.

Is CVE-2024-45507 known to be exploited?

14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Apache Software Foundation Ofbiz

CVE-2024-45507

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fi…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.895 (99.6th percentile) — read the EPSS interpretation.

Affected products

Apache Software Foundation Ofbiz — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

References

ofbiz.apache.org/download.html (mitigation, product, release-notes)
ofbiz.apache.org/security.html (patch)
issues.apache.org/jira/browse/OFBIZ-13132 (issue-tracking)
lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy (vendor-advisory)

Frequently asked questions

What is CVE-2024-45507?: CVE-2024-45507 is a vulnerability in Apache Software Foundation Ofbiz, classified under Server-Side Request Forgery (SSRF). Published 2024-09-04.
Is CVE-2024-45507 known to be exploited?: 14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.