Actively exploited · Published May 8, 2024 · Assigned by apache
CVE-2024-32113Apache OFBiz: Path traversal leading to RCE
Critical 9.1 Exploited
In plain English
A critical-severity path traversal in Apache OFBiz from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on August 7, 2024). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 28, 2024.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 – before 18.12.13 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://ofbiz.apache.org/download.html mitigation
- https://ofbiz.apache.org/security.html related
- https://issues.apache.org/jira/browse/OFBIZ-13006 issue-tracking
- https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd vendor-advisory
- http://www.openwall.com/lists/oss-security/2024/05/09/1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32113 government-resource