CVE-2020-1943

MEDIUMNuclei

Apache OFBiz Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-1943 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 5, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Apache OFBiz

Browse Apache / Apache OFBiz
CVE List16.11.01 to 16.11.07affected

OFBiz

Browse Apache / OFBiz
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMApache OFBiz <=16.11.07 - Cross-Site ScriptingCVSS 6.1

Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade Apache OFBiz to a version higher than 16.11.07 to mitigate this vulnerability.

WeaknessesCWE-79
Authorspdteam
Template tagscve2020cveapachexssofbizvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
Shodan: http.html:"ofbiz"
Shodan: ofbiz.visitor=
FOFA: body="ofbiz"
FOFA: app="apache_ofbiz"
https://lists.apache.org/thread.html/rf867d9a25fa656b279b16e27b8ff6fcda689cfa4275a26655c685702%40%3Cdev.ofbiz.apache.org%3E https://s.apache.org/pr5u8 https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E https://nvd.nist.gov/vuln/detail/CVE-2020-1943

Source: ProjectDiscovery

References

8