Description
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.
This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.
Even unauthenticated attackers can exploit this vulnerability.
Users are recommended to upgrade to version 24.09.02, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | < 24.09.02 | 24.09.02 |
Advisories 1
- WID-SEC-2025-1716 Apache OFBiz: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 17, 2025
References
- https://ofbiz.apache.org/download.html mitigation
- https://ofbiz.apache.org/security.html related
- https://ofbiz.apache.org/release-notes-24.09.02.html release-notes
- https://issues.apache.org/jira/browse/OFBIZ-13276 issue-tracking
- https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915 vendor-advisory