Description
The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | OFBiz | OFBiz 16.11.01 to 16.11.05 | — |
References
- [ofbiz-dev] 20190910 [CVE-2019-10073] Apache OFBiz XSS vulnerability in the "ecommerce" component mailing-list
- [ofbiz-commits] 20200206 svn commit: r1873710 - in /ofbiz/site: security.html template/page/security.tpl.php mailing-list
- [ofbiz-commits] 20200430 [ofbiz-site] branch master updated: Update for 2 last CVEs: CVE-2019-0235 & CVE-2019-12425 mailing-list