CVE-2024-23946 — Path Traversal in Software Foundation Apache Ofbiz

CWE-22 — Path TraversalCWE-434 — Unrestricted File Upload4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
2.7%
top 14.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache OfbizApache Ofbiz
Timeline
PublishedFeb 29

Description

Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/ofbiz< 18.12.12

Patches

Patch: ofbiz.apache.org ↗Patch: ofbiz.apache.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-hfjw-45j2-vgcx: Possible path traversal in Apache OFBiz allowing file inclusion↗2024-02-29
▶
CVEList
Apache OFBiz: Path traversal or file inclusion↗2024-02-28
▶

📋Vendor Advisories

1
Apache
Apache ofbiz: CVE-2024-23946↗
▶
CVE-2024-23946 — Path Traversal | cvebase