Apache Software Foundation - Information Disclosure (CVE-2024-38856)

CVE-2024-38856 is an Incorrect Authorization vulnerability in Apache OFBiz that can allow unauthenticated users to execute screen rendering code under certain conditions if endpoint permissions are not properly configured.

CrowdSec has been tracking this vulnerability and its exploits since 25th of October 2024.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2024-38856 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec network telemetry also shows that exploitation of CVE-2024-38856 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Detection of exploitation attempts typically involves requests to unauthenticated endpoints in Apache OFBiz where permission enforcement has been misconfigured.