PT-2019-6676 · Apache · Ofbiz
Johan Hôgre
+1
·
Published
2019-11-26
·
Updated
2023-02-13
·
CVE-2011-3600
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OFBiz versions 16.11.01 through 16.11.04
Description
The issue affects the /webtools/control/xmlrpc endpoint in the OFBiz XML-RPC event handler, making it vulnerable to External Entity Injection. This is achieved by passing DOCTYPE declarations with executable payloads, which can disclose the contents of files in the filesystem. Additionally, it can be used to probe for open network ports and determine whether a file exists or not based on returned error messages.
Recommendations
For OFBiz versions 16.11.01 through 16.11.04, consider disabling access to the /webtools/control/xmlrpc endpoint until a patch is available. As a temporary workaround, restrict the use of the XML-RPC event handler to minimize the risk of exploitation. Avoid using the endpoint for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ofbiz