{"id":"CVE-2024-36104","aliases":["EUVD-2024-35883","GHSA-77m3-6865-xvqj"],"status":"published","title":"Apache OFBiz: Path traversal leading to a RCE","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.14, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.87883,"percentile":0.99764,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2024-06-04T07:25:07Z","modified":"2026-11-03T21:52:36Z","exploits":[{"source":"pocgithub","id":"ggfzx/CVE-2024-36104","title":"ggfzx/CVE-2024-36104","date":"2024-06-17","url":"https://github.com/ggfzx/CVE-2024-36104"},{"source":"pocgithub","id":"Groppoxx/CVE-2024-36104-PoC","title":"Groppoxx/CVE-2024-36104-PoC","date":"2026-07-29","url":"https://github.com/Groppoxx/CVE-2024-36104-PoC"},{"source":"nuclei","id":"CVE-2024-36104","title":"Apache OFBiz - Directory Traversal \u0026 Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36104.yaml"}],"products":[{"vendor":"apache","product":"ofbiz"},{"vendor":"apache software foundation","product":"apache ofbiz"},{"vendor":"apache_software_foundation","product":"apache_ofbiz"}],"references":[{"url":"https://ofbiz.apache.org/download.html","tags":["mitigation","x_transferred","Product","web"]},{"url":"https://ofbiz.apache.org/security.html","tags":["related","x_transferred","Vendor Advisory","web"]},{"url":"https://issues.apache.org/jira/browse/OFBIZ-13092","tags":["issue-tracking","x_transferred","Issue Tracking","report"]},{"url":"https://lists.apache.org/thread/sv0xr8b1j7mmh5p37yldy9vmnzbodz2o","tags":["vendor-advisory","x_transferred","Mailing List","Release Notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/03/1","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36104","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-77m3-6865-xvqj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36104.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-36104","title":"Apache OFBiz: Path traversal leading to a RCE","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.14, which fixes the issue.","status":"published","published":"2024-06-04T07:25:07.746Z","modified":"2026-11-03T23:59:21.824Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-04T00:47:47.540303Z"}],"euvd":[{"id":"EUVD-2024-35883","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.14, which fixes the issue.","status":"published","published":"2024-06-04T07:25:07Z","modified":"2026-11-03T21:52:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T23:01:35.931968Z"}],"ghsa":[{"id":"GHSA-77m3-6865-xvqj","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.14, which fixes the issue.\n\n","status":"published","published":"2024-06-04T09:30:57Z","modified":"2024-07-03T18:44:12Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:57:37.066336Z"}],"nvd":[{"id":"CVE-2024-36104","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.14, which fixes the issue.","status":"published","published":"2024-06-04T08:15:10.733Z","modified":"2026-11-03T22:17:19.597Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-04T00:47:54.173626Z"}],"osv":[{"id":"CVE-2024-36104","title":"Apache OFBiz: Path traversal leading to a RCE","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.14, which fixes the issue.","status":"published","published":"2024-06-04T07:25:07.746Z","modified":"2026-11-05T02:30:42.540539803Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-07T03:07:53.293347Z"}]}}