CVE-2024-25065

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	< 18.12.12
apache	ofbiz	< 18.12.12

References

http://www.openwall.com/lists/oss-security/2024/02/28/10Mailing List
https://issues.apache.org/jira/browse/OFBIZ-12887Issue Tracking
https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfcMailing List
https://ofbiz.apache.org/download.htmlProduct
https://ofbiz.apache.org/release-notes-18.12.12.htmlRelease Notes
https://ofbiz.apache.org/security.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/28/10Mailing List
https://issues.apache.org/jira/browse/OFBIZ-12887Issue Tracking
https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfcMailing List
https://ofbiz.apache.org/download.htmlProduct
https://ofbiz.apache.org/release-notes-18.12.12.htmlRelease Notes
https://ofbiz.apache.org/security.htmlVendor Advisory

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-250664.3RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-control CVE-2024-25075.4The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up CVE-2024-250735.9An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Ex CVE-2024-250745.9An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Ex CVE-2024-250755.1An issue was discovered in Softing uaToolkit Embedded before 1.41.1. When a subscription with a very low MaxNotificationPerPublish parameter CVE-2024-250766.8An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The bootrom function responsible for validating CVE-2024-250779.8An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of fla CVE-2024-250787.4A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB CVE-2024-250797.4A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 befo CVE-2024-25085.3The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_men CVE-2024-250804.7WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.CVE-2024-250814.2Splinefont in FontForge through 20230101 allows command injection via crafted filenames.