The vulnerability is an improper input validation flaw that allows an attacker to override JSON attributes and bypass the URL allowlist, leading to remote code execution. This weakness is classified as CWE-20, and the CVE record also indicates no specific CWE mapping (NVD-CWE-noinfo). Successful exploitation would let the attacker execute arbitrary code, fully compromising confidentiality, integrity, and availability of the affected system.

The flaw exists in Apache OFBiz prior to configuration release 24.09.06. Only those installations running an earlier version are vulnerable; all newer releases contain the fix.

The CVSS score is 6.5, and the EPSS score is less than 1%. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote, where an attacker sends a crafted JSON payload or HTTP request to the vulnerable endpoint; no privileged access is required.