CVE-2019-12425: CSRF
First published: Thu Apr 30 2020(Updated: )
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OFBiz | =17.12.01 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r5181b36218225447d3ce70891eeccfb6d6885309dffd7e0e59091817@%3Cuser.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r907ce90745b52d2d5b6a815de03fd1d5f3831ab579a81d70cfda6f3d@%3Cuser.ofbiz.apache.org%3E
- https://s.apache.org/7sr1x
- https://lists.apache.org/thread.html/r5181b36218225447d3ce70891eeccfb6d6885309dffd7e0e59091817%40%3Cuser.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r907ce90745b52d2d5b6a815de03fd1d5f3831ab579a81d70cfda6f3d%40%3Cuser.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E
Frequently Asked Questions
What is the vulnerability ID for Apache OFBiz 17.12.01?
The vulnerability ID for Apache OFBiz 17.12.01 is CVE-2019-12425.
What is the severity of CVE-2019-12425?
CVE-2019-12425 has a severity of high.
What is the affected software version of CVE-2019-12425?
The affected software version of CVE-2019-12425 is Apache OFBiz 17.12.01.
What is the impact of CVE-2019-12425?
CVE-2019-12425 allows for Host header injection by accepting arbitrary host, which can lead to various attacks, including request smuggling or cross-site scripting.
How can CVE-2019-12425 be fixed?
To fix CVE-2019-12425, it is recommended to update Apache OFBiz to a patched version or apply the necessary security patches provided by the vendor.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/weakness
- agent/event
- agent/source
- vendor/apache
- canonical/apache ofbiz
- version/apache ofbiz/17.12.01