CVE-2025-54466: Apache OFBiz: RCE Vulnerability in scrum plugin
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.
This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.
Even unauthenticated attackers can exploit this vulnerability.
Users are recommended to upgrade to version 24.09.02, which fixes the issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54466?
CVE-2025-54466 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-54466?
To mitigate CVE-2025-54466, upgrade Apache OFBiz to version 24.09.02 or later.
Who can exploit CVE-2025-54466?
CVE-2025-54466 can be exploited by unauthenticated attackers, making it particularly dangerous.
Which versions of Apache OFBiz are affected by CVE-2025-54466?
CVE-2025-54466 affects versions of Apache OFBiz prior to 24.09.02 when the scrum plugin is in use.
What is the nature of the vulnerability described in CVE-2025-54466?
CVE-2025-54466 involves improper control of code generation leading to a code injection vulnerability.