Apache OFBiz Fixes 46 Vulnerabilities, Including Unauthenticated Remote Code Execution

Apache OFBiz disclosed 46 vulnerabilities, including issues described as critical, affecting all versions before 24.09.08. The flaws include unauthenticated and authenticated remote code execution, authentication and authorization bypasses, information disclosure, injection, path traversal, and denial of service. Weaknesses in JWT authentication, password reset, and credential protection could enable administrative access or account takeover.

The vulnerabilities could also permit unauthorized changes to orders, payments, financial balances, and other business data, extending the potential impact beyond system compromise to transaction integrity. The Apache advisory directs users to upgrade to OFBiz 24.09.08, which it identifies as addressing the vulnerabilities. Organizations running earlier releases should prioritize the upgrade; the announcement provides neither exploitation status nor CVSS scores.