CVE-2019-10074: vulnerability in Apache OFBiz
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.4%
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533
Affected products
Apache · OFBizRelated CVEs — Apache OFBiz
In the same product, most dangerous first.