CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2024-32113Public Exploit

Apache OFBiz - Path Traversal (CVE-2024-32113)

PublishedMay 8, 2024
First SeenNov 26, 2024
Last Seen
Reported
CVSS9.1
Apache
ApacheOFBiz
java

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

psychologyCrowdSec Analysis

CVE-2024-32113 is a severe path traversal vulnerability affecting Apache OFBiz, allowing unauthorized access to sensitive files and potential remote code execution.

CrowdSec has been tracking this vulnerability and its exploits since 19th of July 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-32113 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed attack attempts specifically target URL paths under /webtools/control/forgotpassword;/programexport or similar encodings that may bypass directory restrictions.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2024-05-08
Rule Released2024-07-19
CISA KEV2024-08-07
CISA Remediation Deadline2024-08-28
CrowdSec First Seen2024-11-26

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References