Every CVE Search/ Get API key

CVE-2024-32113

Apache OFBiz: Path traversal leading to RCE

9.8 CriticalIn KEVPublic exploit

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 99.9 points since May 9, 2024
90%50%10%1%

What each source reports

NVD Score used 9.8

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Record
CVE-2024-32113
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List 9.1

Apache OFBiz: Path traversal leading to RCE

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Record
CVE-2024-32113
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2024-29935 9.1

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Record
EUVD-2024-29935
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-38cv-ch3v-j5cw 9.1

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Record
GHSA-38cv-ch3v-j5cw
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
CISA KEV No score

Apache OFBiz Path Traversal Vulnerability

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

Record
CVE-2024-32113
Weakness
CWE-22
Updated
2026-11-02
OSV 9.1

Apache OFBiz: Path traversal leading to RCE

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.

Record
CVE-2024-32113
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubRacerZ-fighting/CVE-2024-32113-POC2024-04-10
Exploit-DBApache OFBiz 18.12.12 - Directory Traversal2024-05-19
MetasploitApache OFBiz forgotPassword/ProgramExport RCE2024-05-30
PoC in GitHubMr-xn/CVE-2024-321132024-06-03
PoC in GitHubYongYe-Security/CVE-2024-321132024-08-07
PoC in GitHubguinea-offensive-security/Ofbiz-RCE2025-07-11
PoC in GitHubluizgaf/CVE-2024-32113-Exploit2025-10-09
NucleiApache OFBiz Directory Traversal - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-32113 is a critical vulnerability (CVSS 9.8) in Apache Ofbiz, published May 8, 2024. CISA lists it as known to be exploited, since August 7, 2024. EUVD reports exploitation since August 7, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open