PT-2019-11182 · Apache+1 · Apache Ofbiz+3
Published
2019-09-11
·
Updated
2020-02-06
·
CVE-2019-0189
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Apache Ofbiz versions prior to 16.11.06
Description:
The issue is related to Java serialisation problems caused by the java.io.ObjectInputStream. It is exposed through the "webtools/control/httpService" URL and uses Java deserialization for code execution. The HttpEngine passes the value of the
serviceContext request parameter to the deserialize method of XmlSerializer. Apache Ofbiz is affected due to its dependencies on "commons-beanutils" and an outdated version of "commons-fileupload".Recommendations:
For versions prior to 16.11.06, upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16. As a temporary workaround, consider restricting access to the "webtools/control/httpService" URL and limiting the use of the
serviceContext parameter in the HttpEngine until the issue is resolved.Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Ofbiz
Java
Commons-Beanutils
Commons-Fileupload