CVE-2018-17200: Critical severity apache ofbiz vulnerability
The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the serviceContent parameter in the request and deserializes it using XStream. This XStream instance is slightly guarded by disabling the creation of ProcessBuilder. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache OFBiz vulnerability?
The vulnerability ID for this Apache OFBiz vulnerability is CVE-2018-17200.
What is the severity level of CVE-2018-17200?
The severity level of CVE-2018-17200 is critical.
How does the Apache OFBiz HTTP engine handle requests for HTTP services?
The Apache OFBiz HTTP engine handles requests for HTTP services via the /webtools/control/httpService endpoint.
What is the affected software for CVE-2018-17200?
The affected software for CVE-2018-17200 is Apache OFBiz version 16.11.01 to 16.11.05.
Is there a fix available for CVE-2018-17200?
Yes, there is a fix available for CVE-2018-17200. It is recommended to update to a version of Apache OFBiz that is not affected by this vulnerability.