Not rated
CVE-2019-10074 An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been…
Description
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OFBiz | Versions not published |
References
Timeline
- Published
- Last modified
Other CVEs of OFBiz
The 11 CVEs of OFBiz →
CVE-2024-48962
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper…
8.9
High
CVE-2024-45195
Apache OFBiz Forced Browsing Vulnerability
Not rated
CVE-2024-38856
Apache OFBiz Incorrect Authorization Vulnerability
Not rated
CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability
Not rated