--- title: Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote... description: A critical zero-day pre-authentication remote code execution (RCE) vulnerability, CVE-2024-38856, has been discovered in Apache OFBiz ERP. It affects versions... canonical: https://daily.dev/posts/critical-zero-day-flaw-in-apache-ofbiz-erp-allows-remote-code-execution-lsjlj5hfj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution | daily.dev og:description: A critical zero-day pre-authentication remote code execution (RCE) vulnerability, CVE-2024-38856, has been discovered in Apache OFBiz ERP. It affects versions... og:url: https://daily.dev/posts/critical-zero-day-flaw-in-apache-ofbiz-erp-allows-remote-code-execution-lsjlj5hfj og:image: https://api.daily.dev/og/posts/lsjLj5Hfj.png og:image:alt: Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary A critical zero-day pre-authentication remote code execution (RCE) vulnerability, CVE-2024-38856, has been discovered in Apache OFBiz ERP. It affects versions before 18.12.15 and allows unauthenticated users to execute arbitrary code by exploiting the override view functionality. Organizations using Apache OFBiz, including notable users like IBM and United Airlines, are urged to upgrade to version 18.12.15 immediately to mitigate the high risk posed by this flaw. ## Content # Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution A critical zero-day pre-authentication remote code execution (RCE) vulnerability has been discovered in Apache OFBiz ERP, marked as CVE-2024-38856. This flaw, which has a CVSS score of 9.8, affects versions prior to 18.12.15 and exploits the override view functionality in crucial endpoints, allowing unauthenticated users to gain unauthorized access and execute arbitrary code. ## Vulnerability Details Discovered by SonicWall, this vulnerability is the fifth critical flaw in Apache OFBiz ERP this year. It bypasses a previous patch for another issue (CVE-2024-36104) and permits unauthenticated attackers to access functionalities that typically require login credentials. Once inside, these attackers can carry out data theft or lateral movements within networked applications, posing severe risks to affected organizations. ## Recommendations Organizations using Apache OFBiz, including notable users such as IBM and United Airlines, are strongly advised to upgrade to version 18.12.15 or newer. This action will mitigate the risk posed by this vulnerability and protect against potential exploitation, as the previous version is already being actively targeted in the wild. ## Conclusion Given the critical nature of CVE-2024-38856, immediate action is essential to safeguard your systems. Ensure your OFBiz instance is updated to the latest version to prevent unauthorized access and potential data breaches. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#apache](https://daily.dev/tags/apache), [#erp](https://daily.dev/tags/erp) [View this post on daily.dev](https://daily.dev/posts/critical-zero-day-flaw-in-apache-ofbiz-erp-allows-remote-code-execution-lsjlj5hfj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution","url":"https://daily.dev/posts/critical-zero-day-flaw-in-apache-ofbiz-erp-allows-remote-code-execution-lsjlj5hfj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-zero-day-flaw-in-apache-ofbiz-erp-allows-remote-code-execution-lsjlj5hfj"},"datePublished":"2024-08-06T04:37:22.531Z","dateModified":"2024-08-06T04:37:37.774Z","description":"A critical zero-day pre-authentication remote code execution (RCE) vulnerability, CVE-2024-38856, has been discovered in Apache OFBiz ERP. It affects versions...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f994667e4dffab72a311815f84fb9917?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f994667e4dffab72a311815f84fb9917?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-zero-day-flaw-in-apache-ofbiz-erp-allows-remote-code-execution-lsjlj5hfj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability,apache,erp","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Critical Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution"}]} ```