CVE-2025-30676: Apache OFBiz: Stored XSS Vulnerability
Published Apr 1, 2025
·Updated
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.19.
Users are recommended to upgrade to version 18.12.19, which fixes the issue.
Affected Software
2 affected components
Apache OFBiz<18.12.19
Apache OFBiz<18.12.19
Remediation
Patch Available
Patch Available
Event History
Apr 1, 2025
CVE Published
via MITRE·02:43 PM
Data Sourced
via MITRE·02:43 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Apr 18, 57228
Event
via FIRST·03:38 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-30676?
CVE-2025-30676 is classified as a low severity vulnerability due to its nature of allowing basic cross-site scripting (XSS) attacks.
2
How do I fix CVE-2025-30676?
To fix CVE-2025-30676, upgrade Apache OFBiz to version 18.12.19 or later.
3
Which versions of Apache OFBiz are affected by CVE-2025-30676?
CVE-2025-30676 affects all versions of Apache OFBiz prior to 18.12.19.
4
What type of vulnerability is CVE-2025-30676?
CVE-2025-30676 is an improper neutralization of script-related HTML tags in a web page, classified as a basic XSS vulnerability.
5
Is there a workaround for CVE-2025-30676?
There are no known workarounds for CVE-2025-30676; the best course of action is to upgrade to a patched version.