PT-2024-4426 · Apache · Apache Ofbiz

Godspeed + 1 · Published 2024-05-15 · Updated 2025-07-01 · CVE-2024-36104

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.14

Description The issue affects Apache OFBiz due to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This vulnerability may allow a remote attacker to execute arbitrary code, potentially leading to full system compromise. Approximately 841 devices may be affected.

Recommendations To resolve the issue, users are recommended to upgrade to version 18.12.14, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable directories until a patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-04928

CVE-2024-36104

Affected Products

Apache Ofbiz

References · 40

• https://lists.apache.org/thread/sv0xr8b1j7mmh5p37yldy9vmnzbodz2o · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36104 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04928 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36104 · Security Note
• https://ofbiz.apache.org/security.html · Vendor Advisory
• https://twitter.com/patchnow24x7/status/1831926968172130696 · Twitter Post
• https://twitter.com/rapid7/status/1831730602313445880 · Twitter Post
• https://twitter.com/Dhananj82759483/status/1831923520563245095 · Twitter Post
• https://t.me/pentestingnews/47647 · Telegram Post
• https://twitter.com/CVEnew/status/1797895238972785121 · Twitter Post
• https://twitter.com/patchnow24x7/status/1831926890065760420 · Twitter Post
• https://twitter.com/oss_security/status/1797630225599406281 · Twitter Post
• https://twitter.com/zoomeye_team/status/1797868942444441909 · Twitter Post
• https://twitter.com/patchnow24x7/status/1831926819823755545 · Twitter Post
• https://twitter.com/patchnow24x7/status/1831923228698407161 · Twitter Post