Apache OFBiz CVE-2024-38856 (unauthenticated screen rendering / incorrect authorization leading to code execution, CISA KEV): which version fixes it?

What it is: CVE-2024-38856 is an incorrect authorization flaw in Apache OFBiz where, under certain preconditions, unauthenticated endpoints could allow execution of screen rendering code for screens that do not check user permissions. It was published August 5, 2024, rated 9.8 by NVD, and added to CISA's KEV catalog on August 27, 2024 after exploitation. Am I affected: - Apache OFBiz releases before 18.12.15 (the project's security page). NVD says through 18.12.14. - Check the version in your OFBiz build or deployment and whether OFBiz or products built on it (ERP, e-commerce apps) are internet-facing. Fix: 1. Upgrade to Apache OFBiz 18.12.15 or later, from the official download page; the project's security page lists the fix commit. 2. Restrict access to administration and backend URLs to trusted networks, and keep OFBiz behind a reverse proxy or WAF. 3. If an unpatched instance was internet-facing, treat it as possibly compromised: review web server logs for unusual requests to backend endpoints, check for unexpected files, scheduled jobs and new processes, and for new users or changed data. Rebuild from a clean source, restore data from a known-good backup, and rotate database credentials, API keys and admin passwords. Verify: the deployed OFBiz is 18.12.15 or later and backend paths are not reachable from untrusted networks. Sources: https://ofbiz.apache.org/security.html https://nvd.nist.gov/vuln/detail/CVE-2024-38856 https://www.cisa.gov/known-exploited-vulnerabilities-catalog