CVE-2011-3600
45Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 16%
da publicação à arma
Publicada no NVD26 de nov.
VulnCheck+1456d
probabilidade de exploração
16%top 3% das CVEs
exploração observada
simVulnCheck
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Produtos afetados
OFBiz · OFBizReferências
http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3Ehttps://access.redhat.com/security/cve/cve-2011-3600https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3Ehttps://security-tracker.debian.org/tracker/CVE-2011-3600