Lucene search

[email protected]CVE-2013-0177

HistoryJan 30, 2014 - 3:06 p.m.

CVE-2013-0177

2014-01-3015:06:22

CWE-79

[email protected]

web.nvd.nist.gov

cve-2013-0177

cross-site scripting

xss

ofbiz

apache

remote injection

web security

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.

Affected configurations

NVD

Node

apacheofbizMatch09.04

apacheofbizMatch09.04.01

apacheofbizMatch10.04

apacheofbizMatch10.04.01

apacheofbizMatch10.04.02

apacheofbizMatch10.04.03

apacheofbizMatch10.04.04

apacheofbizMatch11.04.01

CPENameOperatorVersion
apache:ofbizapache ofbizeq09.04
apache:ofbizapache ofbizeq09.04.01
apache:ofbizapache ofbizeq10.04
apache:ofbizapache ofbizeq10.04.01
apache:ofbizapache ofbizeq10.04.02
apache:ofbizapache ofbizeq10.04.03
apache:ofbizapache ofbizeq10.04.04
apache:ofbizapache ofbizeq11.04.01

CPE	Name	Operator	Version
apache:ofbiz	apache ofbiz	eq	09.04
apache:ofbiz	apache ofbiz	eq	09.04.01
apache:ofbiz	apache ofbiz	eq	10.04
apache:ofbiz	apache ofbiz	eq	10.04.01
apache:ofbiz	apache ofbiz	eq	10.04.02
apache:ofbiz	apache ofbiz	eq	10.04.03
apache:ofbiz	apache ofbiz	eq	10.04.04
apache:ofbiz	apache ofbiz	eq	11.04.01

References

ofbiz.apache.org/download.html#vulnerabilities

osvdb.org/89452

osvdb.org/89453

packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2013/Jan/148

secunia.com/advisories/51812

exchange.xforce.ibmcloud.com/vulnerabilities/81398

fisheye6.atlassian.com/changelog/ofbiz?cs=1432395

fisheye6.atlassian.com/changelog/ofbiz?cs=1432850

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.8%

JSON

Related for CVE-2013-0177

cvelist1 nvd1 packetstorm1 prion1