CVE-2011-3600: XEE
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2011-3600?
CVE-2011-3600 is a vulnerability in the /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler that allows External Entity Injection.
What is the severity of CVE-2011-3600?
The severity of CVE-2011-3600 is high with a severity value of 7.
How can CVE-2011-3600 be exploited?
CVE-2011-3600 can be exploited by passing DOCTYPE declarations with executable payloads to disclose contents of files or probe for open network ports.
Which software is affected by CVE-2011-3600?
The software affected by CVE-2011-3600 is libxmlrpc3-java version 3.1.3-9+deb10u1 and Apache OFBiz versions from 16.11.01 to 16.11.04.
How to fix CVE-2011-3600?
To fix CVE-2011-3600, update to a version of libxmlrpc3-java after 3.1.3-9+deb10u1 or apply the necessary patches for Apache OFBiz versions 16.11.01 to 16.11.04.