CVE-2024-32113

Apache OFBiz before 18.12.13 contains a path traversal vulnerability (CWE-22) in which improper limitation of a pathname allows access to restricted directories outside the intended scope. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw can be triggered remotely by an unauthenticated attacker with no user interaction. Successful exploitation has high impact on confidentiality, integrity, and availability: an attacker can reach files and directories that should be restricted, and the critical 9.8 score indicates potential full compromise of the affected server. Any organization running an affected version of the open-source Apache OFBiz ERP/enterprise automation suite is exposed. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-07, and EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile), amid a wave of critical OFBiz flaws patched in 2024.

What to do: Upgrade all Apache OFBiz instances to version 18.12.13 or later immediately, per the vendor fix and CISA KEV required action. Because the flaw is under active exploitation, prioritize any OFBiz servers exposed to the internet, hunt for signs of compromise on unpatched systems, and restrict network access to OFBiz until patched.