CVE-2011-3600
45Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 16%
from disclosure to weapon
Published on NVDNov 26
VulnCheck+1456d
exploitation probability
16%top 3% of all CVEs
observed exploitation
yesVulnCheck
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Affected products
OFBiz · OFBizReferences
http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3Ehttps://access.redhat.com/security/cve/cve-2011-3600https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3Ehttps://security-tracker.debian.org/tracker/CVE-2011-3600