PT-2019-11417 · Apache · Apache Ofbiz

Published 2019-09-11 · Updated 2020-02-06 · CVE-2019-10073

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.06

Description: The issue affects the "Blog", "Forum", "Contact Us" screens of the "ecommerce" application template in Apache OFBiz, making them susceptible to Stored XSS attacks.

Recommendations: For versions prior to 16.11.06, upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595, and 1860616.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10073

Affected Products

Apache Ofbiz

References · 5

• https://osv.dev/vulnerability/CVE-2019-10073 · Vendor Advisory
• https://s.apache.org/w6edy · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10073 · Security Note
• https://lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3E · Note
• https://lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E · Note