by Kastro
Paper/Archive/CVE-2025-54466

CVE-2025-54466

Apache Software Foundation Apache OFBiz — Apache OFBiz: RCE Vulnerability in scrum plugin

EPSS 27%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.0.980 × 2019.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.

Affected

ProductAffectedFixed inSource
Apache OFBiz< 24.09.0224.09.02CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refofbiz.apache.org/download.htmlrefofbiz.apache.org/security.htmlrefofbiz.apache.org/release-notes-24.09.02.htmlrefissues.apache.org/jira/browse/OFBIZ-13276advisorylists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915refopenwall.com/lists/oss-security/2025/08/05/1