Critical · 9.1 CVE-2024-25065 EUVD-2024-22427GHSA-3vg3-g88w-vjgf

Apache OFBiz: Path traversal allowing authentication bypass.

Published Feb 28, 2024 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OFBiz

Description

Possible path traversal in Apache OFBiz allowing authentication bypass.
Users are recommended to upgrade to version 18.12.12, that fixes the issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache OFBiz	< 18.12.12	18.12.12

Advisories 1

WID-SEC-2024-0505 Apache OFBiz: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 28, 2024

References

https://ofbiz.apache.org/download.html mitigation
https://ofbiz.apache.org/security.html related
https://ofbiz.apache.org/release-notes-18.12.12.html release-notes
https://issues.apache.org/jira/browse/OFBIZ-12887 issue-tracking
https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc vendor-advisory
http://www.openwall.com/lists/oss-security/2024/02/28/10