{"id":"CVE-2024-32113","published":"2024-05-08T15:15:10Z","modified":"2026-06-17T07:29:18Z","title":"Apache OFBiz Path Traversal Vulnerability","vendor":"Apache","product":"OFBiz","tier":"core","eol":null,"description":{"text":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.\n\nUsers are recommended to upgrade to version 18.12.13, which fixes the issue.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a path traversal vulnerability (CWE: improper limitation of a pathname to a restricted directory) in Apache OFBiz, affecting versions before 18.12.13. An attacker with network access can exploit it without authentication, user interaction, or special configuration, to read or modify files outside the intended restricted directory.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:54Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99916,"percentile":0.99968,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-08-07","dueDate":"2024-08-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd; https://nvd.nist.gov/vuln/detail/CVE-2024-32113","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-06-14","exploitedFirstSeen":"2024-06-14","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-14&host_type=src&vulnerability=cve-2024-32113","date":"2024-06-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-26&host_type=src&vulnerability=cve-2024-32113","date":"2024-07-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-27&host_type=src&vulnerability=cve-2024-32113","date":"2024-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-28&host_type=src&vulnerability=cve-2024-32113","date":"2024-07-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-31&host_type=src&vulnerability=cve-2024-32113","date":"2024-07-31"},{"url":"https://isc.sans.edu/diary/Increased+Activity+Against+Apache+OFBiz+CVE202432113/31132","date":"2024-07-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-07&host_type=src&vulnerability=cve-2024-32113","date":"2024-08-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-08-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-12&host_type=src&vulnerability=cve-2024-32113","date":"2024-09-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-13&host_type=src&vulnerability=cve-2024-32113","date":"2024-09-13"}],"evidenceTotal":24,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/05/09/1","tags":["Mailing List"]},{"url":"https://issues.apache.org/jira/browse/OFBIZ-13006","tags":["Vendor Advisory"]},{"url":"https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd","tags":["Mailing List"]},{"url":"https://ofbiz.apache.org/download.html","tags":["Product"]},{"url":"https://ofbiz.apache.org/security.html","tags":["Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/09/1","tags":["Mailing List"]},{"url":"https://issues.apache.org/jira/browse/OFBIZ-13006","tags":["Vendor Advisory"]},{"url":"https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd","tags":["Mailing List"]},{"url":"https://ofbiz.apache.org/download.html","tags":["Product"]},{"url":"https://ofbiz.apache.org/security.html","tags":["Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32113","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Path traversal exploited via public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","start":0,"end":78}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Traversal enables reading arbitrary local files","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Improper Limitation of a Pathname to a Restricted Directory","start":0,"end":59}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-29935","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-29935","exploited":true,"exploitedSince":"2024-08-07","provenance":"source"},"exploits":[{"id":52020,"url":"https://www.exploit-db.com/exploits/52020","title":"Apache OFBiz 18.12.12 - Directory Traversal","type":"webapps","platform":"java","date":"2024-05-19","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2024-05-19"},"pocGithub":{"count":5,"skipped":0,"earliest":"2024-04-10","earliestUrl":"https://github.com/RacerZ-fighting/CVE-2024-32113-POC","repos":[{"name":"Mr-xn/CVE-2024-32113","url":"https://github.com/Mr-xn/CVE-2024-32113","stars":26,"created":"2024-06-03"},{"name":"RacerZ-fighting/CVE-2024-32113-POC","url":"https://github.com/RacerZ-fighting/CVE-2024-32113-POC","stars":7,"created":"2024-04-10"},{"name":"YongYe-Security/CVE-2024-32113","url":"https://github.com/YongYe-Security/CVE-2024-32113","stars":6,"created":"2024-08-07"},{"name":"guinea-offensive-security/Ofbiz-RCE","url":"https://github.com/guinea-offensive-security/Ofbiz-RCE","stars":0,"created":"2025-07-11"},{"name":"luizgaf/CVE-2024-32113-Exploit","url":"https://github.com/luizgaf/CVE-2024-32113-Exploit","stars":0,"created":"2025-10-09"}]},"metasploit":[{"name":"Apache OFBiz forgotPassword/ProgramExport RCE","module":"exploit/multi/http/apache_ofbiz_forgot_password_directory_traversal","type":"exploit","disclosureDate":"2024-05-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb"}],"nuclei":[{"id":"CVE-2024-32113","name":"Apache OFBiz Directory Traversal - Remote Code Execution","severity":"high","path":"http/cves/2024/CVE-2024-32113.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32113.yaml"}],"first":{"date":"2024-04-10","source":"PoC-in-GitHub","url":"https://github.com/RacerZ-fighting/CVE-2024-32113-POC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2024-04-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2024-05-19, Metasploit 2024-05-30","url":"https://github.com/RacerZ-fighting/CVE-2024-32113-POC","provenance":"source"},{"date":"2024-05-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32113","provenance":"source"},{"date":"2024-06-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-14&host_type=src&vulnerability=cve-2024-32113","provenance":"source"},{"date":"2024-08-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-08-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-29935","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":91},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 868 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apache-ofbiz-cwe-22"}}