Apache · OFBiz
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
What it is
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.
Users are recommended to upgrade to version 18.12.13, which fixes the issue.
CISA: Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: August 28, 2024
More exploited flaws from Apache
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 4, 2025 | Forced Browsing | OFBiz | Critical 9.8 | >99.9% |
| Aug 27, 2024 | Incorrect Authorization | OFBiz | High 8.1 | 99.4% |
| Oct 8, 2026 | Command Injection | Struts | High 8.1 | 97% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
| Apr 1, 2025 | Path Equivalence | Tomcat | Critical 10.0 | 99.9% |
| Sep 18, 2024 | Improper Access Control | HugeGraph-Server | Critical 9.8 | 99.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.