Vulnerability · Published Apr 1, 2020 · Assigned by apache
CVE-2020-1943
Medium 6.1
In plain English
A medium-severity security flaw in Apache OFBiz from Apache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 97.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)97.2%top 0.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apache OFBiz | 16.11.01 to 16.11.07 |
References
- https://s.apache.org/pr5u8 x_refsource_MISC
- [ofbiz-commits] 20200430 svn commit: r1877207 - in /ofbiz/site: security.html template/page/security.tpl.php mailing-list, x_refsource_MLIST
- [ofbiz-dev] 20200705 Error.ftl everywhere mailing-list, x_refsource_MLIST
- [ofbiz-dev] 20200715 Re: Error.ftl everywhere mailing-list, x_refsource_MLIST