The Apache OFBiz scrum plugin has a vulnerability due to improper control of code generation, which can lead to remote code execution (RCE). This issue affects versions of Apache OFBiz prior to 24.09.02 when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability, making it critical for users to upgrade to the fixed version.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-54466 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the Apache OFBiz scrum plugin, which may allow them to execute arbitrary code on the server. This can be done without authentication, making it particularly dangerous for systems that have not been updated.
Affected Products
- Apache OFBiz: A framework for enterprise resource planning that includes various plugins, including the scrum plugin, which is affected by this vulnerability.
Mitigation
Users are strongly advised to upgrade to Apache OFBiz version 24.09.02 or later, which addresses this vulnerability and mitigates the risk of exploitation.