Vulnerability · Published Feb 28, 2024 · Assigned by apache
CVE-2024-25065Apache OFBiz: Path traversal allowing authentication bypass.
Critical 9.1
In plain English
A critical-severity path traversal in Apache OFBiz from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 47.7% (higher than 99% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)47.7%top 1.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 – before 18.12.12 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://ofbiz.apache.org/download.html mitigation
- https://ofbiz.apache.org/security.html related
- https://ofbiz.apache.org/release-notes-18.12.12.html release-notes
- https://issues.apache.org/jira/browse/OFBIZ-12887 issue-tracking
- https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc vendor-advisory
- http://www.openwall.com/lists/oss-security/2024/02/28/10