{"id":"CVE-2024-32113","summary":"Apache OFBiz: Path traversal leading to RCE","details":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.\n\nUsers are recommended to upgrade to version 18.12.13, which fixes the issue.","modified":"2026-08-12T14:52:08.754159Z","published":"2024-05-08T14:50:07.272Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32113.json","unresolved_ranges":[{"extracted_events":[{"fixed":"18.12.13"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"fixed":"18.12.13"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/05/09/1"},{"type":"WEB","url":"https://ofbiz.apache.org/download.html"},{"type":"WEB","url":"https://ofbiz.apache.org/security.html"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32113"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32113.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32113"},{"type":"REPORT","url":"https://issues.apache.org/jira/browse/OFBIZ-13006"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/ofbiz-framework","events":[{"introduced":"0"},{"fixed":"2f4d1acdb93c274eb94ead7890b64dd383cb3dad"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"18.12.13"}]}}],"versions":["release18.12.12","release18.12.05","release18.12.04","release18.12.03","release18.12.02","release18.12.01"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/apache/ofbiz-framework/commit/2f4d1acdb93c274eb94ead7890b64dd383cb3dad","target":{"file":"framework/catalina/src/main/java/org/apache/ofbiz/catalina/container/CatalinaContainer.java"},"deprecated":false,"digest":{"line_hashes":["260114081133610030839256009349962373096","15515573443394246656853114603185474342","312045122144459436722579104351384668073","310174252314341226846431211601346991755"],"threshold":0.9},"id":"CVE-2024-32113-34f024c2","signature_type":"Line"},{"target":{"file":"framework/catalina/src/main/java/org/apache/ofbiz/catalina/container/CatalinaContainer.java","function":"prepareTomcatEngineValves"},"deprecated":false,"digest":{"function_hash":"212170997469512983725795026215277029444","length":1308},"id":"CVE-2024-32113-bcfe7987","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/ofbiz-framework/commit/2f4d1acdb93c274eb94ead7890b64dd383cb3dad"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32113.json","vanir_signatures_modified":"2026-08-12T14:52:08Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}