Update CVE-2024-38856.yaml

http/cves/2024/CVE-2024-38856.yaml

@@ -1,16 +1,25 @@
 id: CVE-2024-38856
 
 info:
-  name: Apache OFBiz RCE (CVE-2024-38856)
+  name: Apache OFBiz - Remote Code Execution
   author: Co5mos
   severity: critical
   description: |
-    在apache ofbiz 12.14中，有远程命令执行。用户可以使用特定的 url 来绕过过滤器检测，从而导致未经授权执行 goorvy 代码。
+    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
   reference:
     - https://unam4.github.io/2024/08/05/CVE-2024-38856-ofbiz-12-14-filter%E7%BB%95%E8%BF%87%E5%88%B0rce/
+    - https://issues.apache.org/jira/browse/OFBIZ-13128
+    - https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w
+    - https://ofbiz.apache.org/download.html
+    - https://ofbiz.apache.org/security.html
+  classification:
+    epss-score: 0.00045
+    epss-percentile: 0.16306
   metadata:
-    fofa-query: 'app="Apache_OFBiz"'
-  tags: rce,apache,ofbiz,cve,cve2024
+    verified: true
+    max-request: 1
+    fofa-query: app="Apache_OFBiz"
+  tags: cve,cve2024,ofbiz,apache,rce
 
 http:
   - raw:
@@ -28,6 +37,11 @@ http:
         regex:
           - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
 
+      - type: word
+        part: body
+        words:
+          - 'java.lang.Exception'
+
       - type: status
         status:
           - 200