CVE-2024-32113

The vulnerability results from improper verification of file access paths (CWE-22) — the application does not properly restrict access to directories, allowing an attacker to construct a crafted HTTP request containing path traversal sequences (e.g., '../'). In this way, the attacker can exit the allowed application directory and gain access to sensitive operating system files or perform unauthorized operations. The attack does not require authentication, special privileges, or user interaction, which reflects the highest CVSS vector scores.

An attacker can obtain unauthorized read, write, or execution of files outside the application directory, which may consequently lead to complete system takeover, disclosure of sensitive data, and violation of service integrity and availability.

Apache OFBiz must be immediately updated to version 18.12.13 or later, which eliminates the described vulnerability. Packages are available at https://ofbiz.apache.org/download.html

Apache OFBiz in all versions before 18.12.13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.