CVE-2025-54466 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz…
Critical CVSS: 9.8

CVE-2025-54466

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.

This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.

Even unauthenticated attackers can exploit this vulnerability.


Users are recommended to upgrade to version 24.09.02, which fixes the issue.
Vendor
Apache
Product
Ofbiz
CWE
CWE-94
Yayın Tarihi
2025-08-15 15:15:32
Güncelleme
2025-11-04 22:16:28
Source Identifier
security@apache.org
KEV Date Added
-

Kategoriler

CWE-94 Ofbiz CRITICAL Apache 2025

Referanslar

https://issues.apache.org/jira/browse/OFBIZ-13276 https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915 https://ofbiz.apache.org/download.html https://ofbiz.apache.org/release-notes-24.09.02.html https://ofbiz.apache.org/security.html http://www.openwall.com/lists/oss-security/2025/08/05/1