PT-2025-31969 · Apache+1 · Apache Ofbiz+2

Jarukit Auikritskul + 1 · Published 2025-08-05 · Updated 2025-08-21 · CVE-2025-54466

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 24.09.02

Description: This issue involves improper control of code generation ('Code Injection') in the scrum plugin of Apache OFBiz, potentially leading to Remote Code Execution (RCE). Unauthenticated attackers can exploit this issue.

Recommendations: Upgrade to version 24.09.02.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-54466

Affected Products

Apache Ofbiz

Ofbiz

Ofbiz-Framework

References · 14

• https://osv.dev/vulnerability/CVE-2025-54466 · Vendor Advisory
• https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915 · Vendor Advisory
• https://ofbiz.apache.org/security.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54466 · Security Note
• https://issues.apache.org/jira/browse/OFBIZ-13276 · Patch
• https://twitter.com/CVEnew/status/1956390286155760117 · Twitter Post
• https://twitter.com/oss_security/status/1952742735611339127 · Twitter Post
• https://t.me/cveNotify/132514 · Telegram Post
• https://t.me/cveNotify/133070 · Telegram Post
• https://t.me/CVEtracker/30132 · Telegram Post
• https://ofbiz.apache.org/release-notes-24.09.02.html · Note
• https://t.me/cveNotify/132733 · Telegram Post
• https://ofbiz.apache.org/download.html · Note
• http://openwall.com/lists/oss-security/2025/08/05/1 · Note