Not rated
CVE-2020-1943 Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07
Description
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OFBiz | Versions not published |
References
- s.apache.org s.apache.org
- [ofbiz-commits] 20200430 svn commit: r1877207 - in /ofbiz/site: security.html template/page/security.tpl.php lists.apache.org
- [ofbiz-dev] 20200705 Error.ftl everywhere lists.apache.org
- [ofbiz-dev] 20200715 Re: Error.ftl everywhere lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache OFBiz
The 4 CVEs of Apache OFBiz →
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks
Not rated
CVE-2019-12425
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
Not rated
CVE-2019-12426
an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache…
Not rated