PT-2016-5045 · Apache · Apache Commons Collections+1

Jacques Le Roux · Publicado 2016-04-12 · Atualizado 2022-05-25 · CVE-2016-2170

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 12.04.x through 12.04.05 Apache OFBiz versions 13.07.x through 13.07.02

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Recommendations For Apache OFBiz versions 12.04.x through 12.04.05, update to version 12.04.06 or later. For Apache OFBiz versions 13.07.x through 13.07.02, update to version 13.07.03 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-2170

Produtos afetados

Apache Commons Collections

Apache Ofbiz

Referências · 20

• https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/OFBIZ-6726 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244%40%3Cnotifications.ofbiz.apache.org%3E · Nota
• https://t.me/cvenotify/15622 · Publicação no Telegram
• https://cwiki.apache.org/confluence/display/OFBIZ/The+infamous+Java+serialization+vulnerability · Aviso do Fabricante
• https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications.ofbiz.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a%40%3Cdev.ofbiz.apache.org%3E · Nota
• http://securityfocus.com/archive/1/538034/100/0/threaded · Nota
• https://t.me/cvenotify/12233 · Publicação no Telegram
• https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2170 · Nota de Segurança
• https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6%40%3Cdev.ofbiz.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2016-2170 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661%40%3Cnotifications.ofbiz.apache.org%3E · Nota