CVE-2025-54466
Published: 15 August 2025
Summary
CVE-2025-54466 is a critical-severity Code Injection (CWE-94) vulnerability in Apache Ofbiz. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of the code injection flaw by applying the vendor-recommended upgrade to Apache OFBiz 24.09.02.
Requires validation of all information inputs to block malicious code injection via unauthenticated requests to the scrum plugin.
Limits system to least functionality by permitting disablement of the unnecessary scrum plugin, thereby eliminating exposure to this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated RCE via code injection in a public-facing web application (Apache OFBiz scrum plugin).
NVD Description
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability.…
more
Users are recommended to upgrade to version 24.09.02, which fixes the issue.
Deeper analysisAI
CVE-2025-54466 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, that enables potential remote code execution (RCE) in the scrum plugin of Apache OFBiz. This issue affects Apache OFBiz versions prior to 24.09.02, but only when the scrum plugin is in use. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows remote code execution on the affected system, potentially granting full control to the attacker.
Apache advisories recommend upgrading to version 24.09.02, which resolves the issue. Additional details are available in the official JIRA ticket (OFBIZ-13276), mailing list announcement, download page, release notes for 24.09.02, and the Apache OFBiz security page.
Details
- CWE(s)