CVE-2024-25065: Apache OFBiz path traversal enables authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.1 with network-only, unauthenticated access and high confidentiality and integrity impact, combined with a high EPSS score, makes this a top remediation priority despite no KEV listing.

What it is

Apache OFBiz contains a path traversal flaw (CWE-22) that allows an attacker to bypass authentication. The vendor states the issue is fixed in version 18.12.12, and no affected version range is given in the record beyond that upgrade guidance. Because OFBiz is an enterprise resource planning platform, an authentication bypass exposes business-critical data and functions.

Impact

An unauthenticated attacker can bypass authentication and reach functionality or data that should require a valid session. The CVSS vector rates confidentiality and integrity impact as high, so an attacker could read and modify protected application data.

Attack surface

The flaw is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so it can be triggered directly over HTTP against an exposed OFBiz instance. No authentication is needed to attempt exploitation.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use; EPSS is high at roughly 0.477 (98.8th percentile), indicating elevated likelihood of exploitation activity, but no public exploit reference is included in the supplied data.

What to do

• Upgrade Apache OFBiz to version 18.12.12 or later as directed by the vendor advisory.
• If immediate upgrade is not possible, restrict network access to OFBiz instances to trusted networks and place them behind an authenticating reverse proxy.
• Review OFBiz access logs for traversal-style request paths and unexpected unauthenticated access to administrative or data endpoints.
• Confirm no OFBiz instance is directly exposed to the internet and apply the vendor security guidance from ofbiz.apache.org/security.html.

Detection

• Search web and proxy logs for encoded or plain path traversal sequences (../, %2e%2e%2f) in requests to OFBiz endpoints.
• Alert on successful responses (HTTP 200) to requests that lack a valid authenticated session cookie.
• Monitor for unusual access to OFBiz administrative or data-export URLs from new source IPs.
• Correlate OFBiz application logs with WAF or IDS alerts for traversal patterns targeting the application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.