Apache OFBiz, originally named Open for Business, is a Java-based ERP web application and development framework that offers modules for managing business processes such as accounting, HR, supply chain management, product catalog management, customer relationship management (CRM), manufacturing, e-commerce and more. The framework underpinning it can also be used to build additional custom applications and features.

The software is used globally and across many industries, but it’s unclear how many organizations have Apache OFBiz since many uses it internally. Based on public data, its users include large companies such as IBM, HP, Accenture, United Airlines, Home Depot, and Upwork. Some third-party commercial applications like Atlassian JIRA also use OFBiz modules.

Fragmenting the controller-view map state

The root cause for CVE-2024-45195 and the previous three related flaws are incorrect or insufficient authorization checks for authenticated view maps because the state between the called controller and the accessed view map is corrupted.