CVEs / CVE-2024-32113
CVE-2024-32113: Apache OFBiz Path Traversal Vulnerability
- Known exploited in the CISA KEV catalog since 7 Aug 2024
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-32113
Summary
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache OFBiz | before 18.12.13 | 18.12.13 |
| apache ofbiz | before 18.12.13 | 18.12.13 |
Exploitation
| In CISA KEV since | 7 Aug 2024 |
|---|---|
| Due date for US federal agencies | 28 Aug 2024 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-22 |
References
- CVE-2024-32113 on NVD
- CVE-2024-32113 in the CISA KEV catalog
- https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd (cited by CISA)
- CVE-2024-32113 on OSV
- http://www.openwall.com/lists/oss-security/2024/05/09/1 Mailing List
- https://issues.apache.org/jira/browse/OFBIZ-13006 Vendor Advisory
- https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd Mailing List
- https://ofbiz.apache.org/download.html Product
- https://ofbiz.apache.org/security.html Patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32113 Third Party Advisory, US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.