CVE-2020-1943: XSS
First published: Wed Apr 01 2020(Updated: )
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OFBiz | >=16.11.01<=16.11.07 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ra6c011af63d8a8cd8c0b8f72b2b0c392af4d5ed040ba59be344d13fa@%3Cdev.ofbiz.apache.org%3E
- https://s.apache.org/pr5u8
- https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757%40%3Cdev.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ra6c011af63d8a8cd8c0b8f72b2b0c392af4d5ed040ba59be344d13fa%40%3Cdev.ofbiz.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2020-1943?
The severity of CVE-2020-1943 is medium with a CVSS score of 6.1.
How does CVE-2020-1943 affect Apache OFBiz?
CVE-2020-1943 affects Apache OFBiz versions 16.11.01 to 16.11.07.
What is the CWE ID for CVE-2020-1943?
The CWE ID for CVE-2020-1943 is 79.
How can I fix CVE-2020-1943?
To fix CVE-2020-1943, it is recommended to update Apache OFBiz to a version beyond 16.11.07.
Where can I find more information about CVE-2020-1943?
You can find more information about CVE-2020-1943 in the references provided: [reference 1](https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E), [reference 2](https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E), [reference 3](https://lists.apache.org/thread.html/ra6c011af63d8a8cd8c0b8f72b2b0c392af4d5ed040ba59be344d13fa@%3Cdev.ofbiz.apache.org%3E).
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- agent/source
- vendor/apache
- canonical/apache ofbiz
- version/apache ofbiz/16.11.01
- version/apache ofbiz/16.11.07