Non notée
CVE-2019-10074 An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been…
Description
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OFBiz | Versions non publiées |
Références
Chronologie
- Publiée
- Dernière modification
Autres CVE de OFBiz
Les 11 CVE de OFBiz →
CVE-2024-48962
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper…
8.9
Élevée
CVE-2024-45195
Apache OFBiz Forced Browsing Vulnerability
Non notée
CVE-2024-38856
Apache OFBiz Incorrect Authorization Vulnerability
Non notée
CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability
Non notée