PT-2019-11418 · Apache · Apache Ofbiz

Niels Heinen · Publicado 2019-09-11 · Atualizado 2021-07-21 · CVE-2019-10074

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.06

Description: A remote code execution (RCE) issue is possible when Freemarker markup is entered in a textarea field of an Apache OFBiz Form Widget, specifically when encoding has been disabled on such a field. This was identified in the Customer Request "story" input within the Order Manager application. It is advised that encoding should not be disabled without a valid reason, especially within fields that accept user input.

Recommendations: For versions prior to 16.11.06, upgrade to 16.11.06 or manually apply the commit r1858533 on branch 16.11 as a mitigation measure.

Correção

RCE

Special Elements Injection

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-74

CWE-116

Identificadores relacionados

CVE-2019-10074

Produtos afetados

Apache Ofbiz

Referências · 4

• https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10074 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10074 · Aviso do Fabricante
• https://s.apache.org/r49vw · Aviso do Fabricante