CVE-2011-3600: XEE
First published: Tue Nov 26 2019(Updated: )
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OFBiz | >=16.11.01<=16.11.04 | |
| debian/libxmlrpc3-java |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2011-3600
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600
- https://access.redhat.com/security/cve/cve-2011-3600
- http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E
- https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E
Frequently Asked Questions
What is CVE-2011-3600?
CVE-2011-3600 is a vulnerability in the /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler that allows External Entity Injection.
What is the severity of CVE-2011-3600?
The severity of CVE-2011-3600 is high with a severity value of 7.
How can CVE-2011-3600 be exploited?
CVE-2011-3600 can be exploited by passing DOCTYPE declarations with executable payloads to disclose contents of files or probe for open network ports.
Which software is affected by CVE-2011-3600?
The software affected by CVE-2011-3600 is libxmlrpc3-java version 3.1.3-9+deb10u1 and Apache OFBiz versions from 16.11.01 to 16.11.04.
How to fix CVE-2011-3600?
To fix CVE-2011-3600, update to a version of libxmlrpc3-java after 3.1.3-9+deb10u1 or apply the necessary patches for Apache OFBiz versions 16.11.01 to 16.11.04.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/event
- agent/source
- vendor/apache
- canonical/apache ofbiz
- version/apache ofbiz/16.11.01
- version/apache ofbiz/16.11.04
- package-manager/debian