CVE-2024-25065 - OpenCVE

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/02/28/10
https://issues.apache.org/jira/browse/OFBIZ-12887
https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/release-notes-18.12.12.html
https://ofbiz.apache.org/security.html

History

Thu, 29 Aug 2024 21:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-02-28T15:42:50.448Z

Updated: 2024-08-29T14:51:06.310Z

Reserved: 2024-02-04T08:22:51.943Z

Link: CVE-2024-25065

Vulnrichment

Updated: 2024-08-01T23:36:21.296Z

NVD

Status : Awaiting Analysis

Published: 2024-02-29T01:44:14.480

Modified: 2024-08-29T20:36:15.613

Link: CVE-2024-25065

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25065", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-02-04T08:22:51.943Z", "datePublished": "2024-02-28T15:42:50.448Z", "dateUpdated": "2024-08-29T14:51:06.310Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache OFBiz", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "18.12.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "YunPeng - \u90ed \u8fd0\u9e4f <puata123@outlook.com>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nPossible path traversal in Apache OFBiz allowing authentication bypass.<br>Users are recommended to upgrade to version 18.12.12, that fixes the issue.\n\n"}], "value": "\nPossible path traversal in Apache OFBiz allowing authentication bypass.\nUsers are recommended to upgrade to version 18.12.12, that fixes the issue.\n\n"}], "metrics": [{"other": {"content": {"text": "critical"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "Path traversal allowing authentication bypass.", "lang": "en"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-28T15:42:50.448Z"}, "references": [{"tags": ["mitigation"], "url": "https://ofbiz.apache.org/download.html"}, {"tags": ["related"], "url": "https://ofbiz.apache.org/security.html"}, {"tags": ["release-notes"], "url": "https://ofbiz.apache.org/release-notes-18.12.12.html"}, {"tags": ["issue-tracking"], "url": "https://issues.apache.org/jira/browse/OFBIZ-12887"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/28/10"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache OFBiz: Path traversal allowing authentication bypass.", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.296Z"}, "title": "CVE Program Container", "references": [{"tags": ["mitigation", "x_transferred"], "url": "https://ofbiz.apache.org/download.html"}, {"tags": ["related", "x_transferred"], "url": "https://ofbiz.apache.org/security.html"}, {"tags": ["release-notes", "x_transferred"], "url": "https://ofbiz.apache.org/release-notes-18.12.12.html"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://issues.apache.org/jira/browse/OFBIZ-12887"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/28/10", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "apache", "product": "ofbiz", "cpes": ["cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "18.12.12", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-29T14:49:41.208173Z", "id": "CVE-2024-25065", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T14:51:06.310Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://ofbiz.apache.org/download.html", "tags": ["mitigation", "x_transferred"]}, {"url": "https://ofbiz.apache.org/security.html", "tags": ["related", "x_transferred"]}, {"url": "https://ofbiz.apache.org/release-notes-18.12.12.html", "tags": ["release-notes", "x_transferred"]}, {"url": "https://issues.apache.org/jira/browse/OFBIZ-12887", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/28/10", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.296Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-25065", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-29T14:49:41.208173Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "ofbiz", "versions": [{"status": "affected", "version": "0", "lessThan": "18.12.12", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T14:50:54.917Z"}}], "cna": {"title": "Apache OFBiz: Path traversal allowing authentication bypass.", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "YunPeng - \u90ed \u8fd0\u9e4f <puata123@outlook.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache OFBiz", "versions": [{"status": "affected", "version": "0", "lessThan": "18.12.12", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://ofbiz.apache.org/download.html", "tags": ["mitigation"]}, {"url": "https://ofbiz.apache.org/security.html", "tags": ["related"]}, {"url": "https://ofbiz.apache.org/release-notes-18.12.12.html", "tags": ["release-notes"]}, {"url": "https://issues.apache.org/jira/browse/OFBIZ-12887", "tags": ["issue-tracking"]}, {"url": "https://lists.apache.org/thread/rplfjp7ppn9ro49oo7jsrpj99m113lfc", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/28/10"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nPossible path traversal in Apache OFBiz allowing authentication bypass.\nUsers are recommended to upgrade to version 18.12.12, that fixes the issue.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\nPossible path traversal in Apache OFBiz allowing authentication bypass.<br>Users are recommended to upgrade to version 18.12.12, that fixes the issue.\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "description": "Path traversal allowing authentication bypass."}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-28T15:42:50.448Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25065", "state": "PUBLISHED", "dateUpdated": "2024-08-29T14:51:06.310Z", "dateReserved": "2024-02-04T08:22:51.943Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-02-28T15:42:50.448Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}