This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Apache First view 2006-12-15
Product Ofbiz Last view 2021-08-30
Version Type Application
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:apache:ofbiz:11.04.01:*:*:*:*:*:*:* 21
cpe:2.3:a:apache:ofbiz:12.04.01:*:*:*:*:*:*:* 21
cpe:2.3:a:apache:ofbiz:10.04.01:*:*:*:*:*:*:* 20
cpe:2.3:a:apache:ofbiz:11.04.02:*:*:*:*:*:*:* 20
cpe:2.3:a:apache:ofbiz:10.04.02:*:*:*:*:*:*:* 19
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* 19
cpe:2.3:a:apache:ofbiz:12.04.02:*:*:*:*:*:*:* 19
cpe:2.3:a:apache:ofbiz:12.04.03:*:*:*:*:*:*:* 19
cpe:2.3:a:apache:ofbiz:13.07.02:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:12.04.04:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:13.07.01:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:12.04.05:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:11.04.04:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:11.04.03:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:10.04.04:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:10.04.03:*:*:*:*:*:*:* 18
cpe:2.3:a:apache:ofbiz:09.04:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:11.04.06:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:11.04:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:12.04.06:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:12.04:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:11.04.05:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:13.07:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:10.04:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:10.04.05:*:*:*:*:*:*:* 17
cpe:2.3:a:apache:ofbiz:13.07.03:*:*:*:*:*:*:* 16
cpe:2.3:a:apache:ofbiz:09.04.01:*:*:*:*:*:*:* 16
cpe:2.3:a:apache:ofbiz:16.11.02:*:*:*:*:*:*:* 15
cpe:2.3:a:apache:ofbiz:16.11.03:*:*:*:*:*:*:* 15
cpe:2.3:a:apache:ofbiz:16.11.01:*:*:*:*:*:*:* 15
cpe:2.3:a:apache:ofbiz:17.12.01:*:*:*:*:*:*:* 8
cpe:2.3:a:apache:ofbiz:17.12.03:*:*:*:*:*:*:* 7

Related : CVE

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
7.5 2021-08-30 CVE-2021-25958

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.

9.8 2021-08-18 CVE-2021-37608

Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.

9.8 2021-04-27 CVE-2021-30128

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

9.8 2021-04-27 CVE-2021-29200

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

9.8 2021-03-22 CVE-2021-26295

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

6.1 2020-07-15 CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

5.3 2020-07-15 CVE-2020-13923

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04

7.5 2020-04-30 CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host

8.8 2020-04-30 CVE-2019-0235

Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

6.1 2020-04-01 CVE-2020-1943

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

5.3 2020-02-06 CVE-2019-12426

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06

7.5 2019-11-26 CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

9.8 2019-09-11 CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

6.1 2019-09-11 CVE-2019-10073

The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616

9.8 2019-09-11 CVE-2019-0189

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16

9.8 2019-09-11 CVE-2018-17200

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019

7.5 2018-12-13 CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.

9.8 2018-01-04 CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window would execute.

9.8 2017-10-26 CVE-2012-1622

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.

6.1 2017-08-30 CVE-2016-6800

The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01.

8.8 2017-08-30 CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

9.8 2016-04-12 CVE-2016-2170

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

6.1 2016-04-12 CVE-2015-3268

Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.

4.3 2014-08-22 CVE-2014-0232

Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1) result or (2) error message.

4.3 2014-06-19 CVE-2012-1621

Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request. NOTE: some of these details are obtained from third party information.

CWE : Common Weakness Enumeration

%idName
35% (10) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
17% (5) CWE-502 Deserialization of Untrusted Data
10% (3) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')
10% (3) CWE-20 Improper Input Validation
3% (1) CWE-639 Access Control Bypass Through User-Controlled Key
3% (1) CWE-611 Information Leak Through XML External Entity File Disclosure
3% (1) CWE-434 Unrestricted Upload of File with Dangerous Type
3% (1) CWE-352 Cross-Site Request Forgery (CSRF)
3% (1) CWE-209 Information Exposure Through an Error Message
3% (1) CWE-200 Information Exposure
3% (1) CWE-116 Improper Encoding or Escaping of Output

CAPEC : Common Attack Pattern Enumeration & Classification

id Name
CAPEC-133 Try All Common Application Switches and Options

Open Source Vulnerability Database (OSVDB)

id Description
64522 Apache Open For Business Project (OFBiz) ecommerce/control/contactus Multiple...
64521 Apache Open For Business Project (OFBiz) Web Tools Section entityName Paramet...
64520 Apache Open For Business Project (OFBiz) ecommerce/control/ViewBlogArticle co...
64519 Apache Open For Business Project (OFBiz) Control Servlet URI XSS
64518 Apache Open For Business Project (OFBiz) Show Portal Page Section start Param...
64517 Apache Open For Business Project (OFBiz) View Profile Section partyId Paramet...
64516 Apache Open For Business Project (OFBiz) Export Product Listing Section produ...
32397 Opentaps ecommerce/control/keywordsearch SEARCH_STRING Parameter XSS
32396 Apache Open For Business Project (OFBiz) Ecommerce Component Forum Implementa...
32395 Apache Open For Business Project (OFBiz) Ecommerce Component Form Field Manip...

ExploitDB Exploits

id Description
12330 Multiple XSS in Apache OFBiz
12264 Apache OFBiz FULLADMIN Creator PoC Payload
12263 Apache OFBiz SQL Remote Execution PoC Payload

OpenVAS Exploits

id Description
2010-04-29 Name : Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
File : nvt/secpod_ofbiz_mult_xss_vuln.nasl
2009-04-24 Name : Opentaps ERP + CRM Search_String Parameter HTML injection vulnerability
File : nvt/remote-Opentaps-htmlIjection.nasl
2009-04-22 Name : Apache Open For Business HTML injection vulnerability
File : nvt/remote-ApacheOfbiz-htmlInjection.nasl

Snort® IPS/IDS

Date Description
2020-11-12 Apache OFBiz XMLRPC deserialization attempt
RuleID : 55978 - Type : SERVER-OTHER - Revision : 1

Nessus® Vulnerability Scanner

id Description
2013-07-29 Name: The remote web application is affected by a code execution vulnerability.
File: ofbiz_nested_script_uel_function_execution.nasl - Type: ACT_ATTACK
2012-05-23 Name: The remote web application has a code execution vulnerability.
File: ofbiz_nested_script_rce.nasl - Type: ACT_ATTACK
2012-05-23 Name: The remote web application has a cross-site scripting vulnerability.
File: ofbiz_webslinger_xss.nasl - Type: ACT_ATTACK