PT-2019-11182 · Apache+1 · Apache Ofbiz+3

Publicado

2019-09-11

·

Atualizado

2020-02-06

·

CVE-2019-0189

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Apache Ofbiz versions prior to 16.11.06
Description: The issue is related to Java serialisation problems caused by the java.io.ObjectInputStream. It is exposed through the "webtools/control/httpService" URL and uses Java deserialization for code execution. The HttpEngine passes the value of the serviceContext request parameter to the deserialize method of XmlSerializer. Apache Ofbiz is affected due to its dependencies on "commons-beanutils" and an outdated version of "commons-fileupload".
Recommendations: For versions prior to 16.11.06, upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16. As a temporary workaround, consider restricting access to the "webtools/control/httpService" URL and limiting the use of the serviceContext parameter in the HttpEngine until the issue is resolved.

Correção

Deserialization of Untrusted Data

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-0189

Produtos afetados

Apache Ofbiz
Java
Commons-Beanutils
Commons-Fileupload