PT-2019-11418 · Apache · Apache Ofbiz

Niels Heinen · Published 2019-09-11 · Updated 2021-07-21 · CVE-2019-10074

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.06

Description: A remote code execution (RCE) issue is possible when Freemarker markup is entered in a textarea field of an Apache OFBiz Form Widget, specifically when encoding has been disabled on such a field. This was identified in the Customer Request "story" input within the Order Manager application. It is advised that encoding should not be disabled without a valid reason, especially within fields that accept user input.

Recommendations: For versions prior to 16.11.06, upgrade to 16.11.06 or manually apply the commit r1858533 on branch 16.11 as a mitigation measure.

Fix

RCE

Special Elements Injection

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-74

CWE-116

Related Identifiers

CVE-2019-10074

Affected Products

Apache Ofbiz

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-10074 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10074 · Vendor Advisory
• https://s.apache.org/r49vw · Vendor Advisory
• https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E · Note