PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31379 Apache Software Foundation CVE debrief

Apache OFBiz versions prior to 24.09.06 contain multiple vulnerability classes: Cross-site Scripting (CWE-79), Path Traversal (CWE-22), and Code Injection (CWE-94). The vendor published advisory details on 2026-05-19. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope change, with low impacts to confidentiality and integrity. No availability impact is scored. The vendor recommends upgrading to version 24.09.06 to remediate these issues. No known exploitation in ransomware campaigns has been reported.

Vendor
Apache Software Foundation
Product
Apache OFBiz
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

Organizations running Apache OFBiz versions prior to 24.09.06, particularly those with externally accessible deployments or multi-tenant environments where scope change impacts could amplify risk across trust boundaries.

Technical summary

Apache OFBiz before 24.09.06 is affected by three vulnerability types: improper neutralization of input during web page generation (XSS/CWE-79), improper limitation of pathname to restricted directory (Path Traversal/CWE-22), and improper control of code generation (Code Injection/CWE-94). The CVSS 3.1 score of 6.1 (Medium) reflects network accessibility with required user interaction and scope change. Successful exploitation could allow attackers to execute scripts in user browsers, access files outside intended directories, or inject and execute arbitrary code. The vendor has released version 24.09.06 containing fixes.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Apache OFBiz to version 24.09.06 or later
  • Review application logs for suspicious input patterns consistent with XSS, path traversal, or code injection attempts
  • Validate that web application firewalls or input filtering rules address the identified CWE classes
  • Monitor Apache OFBiz security mailing lists for additional guidance

Evidence notes

CWE-79 (XSS), CWE-22 (Path Traversal), and CWE-94 (Code Injection) are explicitly listed as weakness enumerations. CPE criteria confirms affected versions are all versions before 24.09.06. CVSS vector and score derived from NVD source data.

Official resources

Apache disclosed this vulnerability via their security mailing list on 2026-05-19, with NVD publishing the record the same day. The modified timestamp (2026-05-19T19:16:47.323Z) suggests same-day updates to the entry.