CVE-2019-10074

2019-09-1120:38:56

apache

www.cve.org

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.0%

JSON

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request “story” input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

CNA Affected

[
  {
    "product": "OFBiz",
    "vendor": "Apache",
    "versions": [
      {
        "status": "affected",
        "version": "OFBiz 16.11.01 to 16.11.05"
      }
    ]
  }
]