Path traversal in OFBiz - CVE-2024-36104
Published: June 5, 2024
Vulnerability identifier: #VU91168
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-36104
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Successful exploitation of the vulnerability may allows an attacker to execute arbitrary code.
Affected software
OFBiz
How to mitigate CVE-2024-36104
Install update from vendor's website.
OFBiz - update to 18.12.14