Not rated
CVE-2019-10073 The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to…
Description
The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OFBiz | Versions not published |
References
- [ofbiz-dev] 20190910 [CVE-2019-10073] Apache OFBiz XSS vulnerability in the "ecommerce" component s.apache.org
- [ofbiz-commits] 20200206 svn commit: r1873710 - in /ofbiz/site: security.html template/page/security.tpl.php lists.apache.org
- [ofbiz-commits] 20200430 [ofbiz-site] branch master updated: Update for 2 last CVEs: CVE-2019-0235 & CVE-2019-12425 lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of OFBiz
The 11 CVEs of OFBiz →
CVE-2024-48962
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper…
8.9
High
CVE-2024-45195
Apache OFBiz Forced Browsing Vulnerability
Not rated
CVE-2024-38856
Apache OFBiz Incorrect Authorization Vulnerability
Not rated
CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability
Not rated