Ofbiz
Vendor:
First CVE: Dec 15, 2006 · Active for 19 years
76
Total CVEs
More Total CVEs than 99% of tracked products
4.8
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
3.9%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Ofbiz over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 15, 2006
19 years ago
Most Recent CVE
Jun 10, 2026
46 days ago
CVE Severity & Scoring
Ofbiz76 CVEs
37%
29%
32%
All CVEs352,719 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network65 (85.5%)
Unknown10 (13.2%)
Physical1 (1.3%)
Adjacent Network0 (0.0%)
Attack Complexity
Low66 (86.8%)
High0 (0.0%)
Unknown10 (13.2%)
User Interaction
None55 (72.4%)
Unknown10 (13.2%)
Required11 (14.5%)
Privileges Required
Low5 (6.6%)
High0 (0.0%)
None61 (80.3%)
Unknown10 (13.2%)
Top CVEs
Signals from CVEs in this product scope (76 CVEs).
76 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-32113CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.
Users are recommende | May 8, 2024 | 9.8 | 99 | YES | YES |
CVE-2024-38856CRITICAL Incorrect Authorization vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: through 18.12.14.
Users are recommended to upgrade to version 18.12.15, which fixes the is | Aug 5, 2024 | 9.8 | 98 | YES | YES |
CVE-2024-45195HIGH Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fi | Sep 4, 2024 | 7.5 | 97 | YES | YES |
CVE-2023-51467CRITICAL The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
| Dec 26, 2023 | 9.8 | 91 | NO | YES |
CVE-2023-49070CRITICAL Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10.
Users are recommended to upgrade | Dec 5, 2023 | 9.8 | 91 | NO | YES |
CVE-2021-26295CRITICAL Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. | Mar 22, 2021 | 9.8 | 91 | NO | YES |
CVE-2020-9496MEDIUM XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 | Jul 15, 2020 | 6.1 | 91 | NO | YES |
CVE-2024-45507CRITICAL Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Use | Sep 4, 2024 | 9.8 | 87 | NO | YES |
CVE-2024-36104CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.
Users are recommend | Jun 4, 2024 | 9.1 | 84 | NO | YES |
CVE-2021-30128CRITICAL Apache OFBiz has unsafe deserialization prior to 17.12.07 version | Apr 27, 2021 | 9.8 | 82 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (76 CVEs).
CISA KEV
3 CVEs
3.9% of CVEs· 97th percentile
Metasploit
6 CVEs
7.9% of CVEs· 97th percentile
Nuclei
16 CVEs
21.1% of CVEs· 98th percentile
ExploitDB
5 CVEs
6.6% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (76 CVEs).
Media Mentions
Signals from CVEs in this product scope (76 CVEs).
Top CNAs Publishing CVEs For Ofbiz
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 18.12.17 | 1 | 3.5 | 0.6% | 0 | 0 |
| 17.12.03 | 1 | 6.1 | 98.9% | 0 | 1 |
| 17.12.01 | 2 | 8.2 | 18.7% | 0 | 1 |
| 16.11.03 | 1 | 9.8 | 3.3% | 0 | 0 |
| 16.11.02 | 1 | 9.8 | 3.3% | 0 | 0 |
| 16.11.01 | 1 | 9.8 | 3.3% | 0 | 0 |
| 13.07.03 | 2 | 7.5 | 3.7% | 0 | 0 |
| 13.07.02 | 3 | 7.0 | 5.5% | 0 | 0 |
| 13.07.01 | 3 | 7.0 | 5.5% | 0 | 0 |
| 13.07 | 2 | 7.5 | 3.7% | 0 | 0 |
| 12.04.06 | 2 | 7.5 | 3.7% | 0 | 0 |
| 12.04.05 | 3 | 7.0 | 5.5% | 0 | 0 |
| 12.04.04 | 3 | 7.0 | 5.5% | 0 | 0 |
| 12.04.03 | 4 | 6.3 | 6.2% | 0 | 0 |
| 12.04.02 | 4 | 6.3 | 6.2% | 0 | 0 |
| 12.04.01 | 6 | 6.6 | 7.4% | 0 | 0 |
| 12.04 | 2 | 7.5 | 3.7% | 0 | 0 |
| 11.04.06 | 2 | 7.5 | 3.7% | 0 | 0 |
| 11.04.05 | 2 | 7.5 | 3.7% | 0 | 0 |
| 11.04.04 | 3 | 6.4 | 5.2% | 0 | 0 |