CVE-2019-10073: XSS
First published: Wed Sep 11 2019(Updated: )
The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OFBiz | >=16.11.01<=16.11.05 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f@%3Ccommits.ofbiz.apache.org%3E
- https://s.apache.org/w6edy
- https://lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3E
Frequently Asked Questions
What is CVE-2019-10073?
CVE-2019-10073 is a vulnerability in the "Blog", "Forum", and "Contact Us" screens of the "ecommerce" application bundled in Apache OFBiz that allows for Stored XSS attacks.
What is the severity of CVE-2019-10073?
CVE-2019-10073 has a severity rating of 6.1, which is considered medium.
How can I mitigate CVE-2019-10073?
To mitigate CVE-2019-10073, you should upgrade to version 16.11.06 of Apache OFBiz or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595, and 1860616.
What is the affected software for CVE-2019-10073?
The affected software for CVE-2019-10073 is Apache OFBiz version 16.11.05 and earlier.
What is the CWE for CVE-2019-10073?
The CWE (Common Weakness Enumeration) for CVE-2019-10073 is CWE-79 (Improper Neutralization of Input During Web Page Generation).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- agent/source
- vendor/apache
- canonical/apache ofbiz
- version/apache ofbiz/16.11.01
- version/apache ofbiz/16.11.05