PT-2020-9311 · Apache · Apache Ofbiz

Pradeep Jairamani · Published 2020-04-30 · Updated 2021-05-03 · CVE-2019-12425

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache OFBiz version 17.12.01

Description: The issue concerns Host header injection, where the software accepts arbitrary host headers. This can potentially lead to various security issues.

Recommendations: For Apache OFBiz version 17.12.01, as a temporary workaround, consider restricting access to the Host header to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-12425

Affected Products

Apache Ofbiz

References · 10

• https://s.apache.org/7sr1x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12425 · Security Note
• https://t.me/cvenotify/11678 · Telegram Post
• https://t.me/cvenotify/11914 · Telegram Post
• https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E · Note
• https://lists.apache.org/thread.html/r907ce90745b52d2d5b6a815de03fd1d5f3831ab579a81d70cfda6f3d%40%3Cuser.ofbiz.apache.org%3E · Note
• https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E · Note
• https://t.me/cvenotify/3456 · Telegram Post
• https://lists.apache.org/thread.html/r5181b36218225447d3ce70891eeccfb6d6885309dffd7e0e59091817%40%3Cuser.ofbiz.apache.org%3E · Note