The Apache Software Foundation has released a critical security advisory addressing an unauthenticated remote code execution vulnerability in Apache OFBiz (CVE-2024-45195, CVSS 9.8). This flaw bypasses previous patches like CVE-2024-41857, and public proof-of-concept exploits have already surfaced.

Controller Access Bypass and Code Execution

The vulnerability originates from inconsistent URL routing validation within the web presentation tier. Unauthenticated attackers can transmit crafted requests that circumvent internal security controllers, ultimately executing arbitrary Groovy scripts or Java bytecode in the server runtime.

Affected Deployments and Patch Deployment

All deployments on Apache OFBiz version 18.12.15 or older are vulnerable. Administrators must upgrade immediately to Apache OFBiz 18.12.16. If an immediate upgrade is impossible, enforce strict reverse-proxy rules to block unauthenticated access to sensitive controller endpoints.