CVE-2018-8033: Infoleak
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-8033?
CVE-2018-8033 is a vulnerability in Apache OFBiz versions 16.11.01 to 16.11.04 that allows an attacker to execute arbitrary code or conduct remote command execution.
How does CVE-2018-8033 impact Apache OFBiz?
CVE-2018-8033 impacts Apache OFBiz by allowing attackers to exploit the HTTP engine and execute malicious code or commands.
What is the severity of CVE-2018-8033?
The severity of CVE-2018-8033 is high, with a severity value of 7.5.
How can I fix CVE-2018-8033 in Apache OFBiz?
To fix CVE-2018-8033 in Apache OFBiz, you should upgrade to version 16.11.05 or later, which includes a patch for the vulnerability.
Are there any references for CVE-2018-8033?
Yes, you can find more information about CVE-2018-8033 at the following reference: [link](https://lists.apache.org/thread.html/e8fb551e86e901932081f81ee9985bb72052b4d412f23d89b1282777@%3Cuser.ofbiz.apache.org%3E).