Cross-site scripting in OFBiz

1) Cross-site scripting

EUVDB-ID: #VU42096

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2013-0177

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Vulnerable software versions

OFBiz: 09.04 - 11.04.01

CPE2.3

• cpe:2.3:a:apache_foundation:ofbiz:09.04:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:ofbiz:09.04.01:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:ofbiz:10.04:*:*:*:*:*:*:*

External links

https://ofbiz.apache.org/download.html#vulnerabilities
https://osvdb.org/89452
https://osvdb.org/89453
https://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html
https://seclists.org/fulldisclosure/2013/Jan/148
https://secunia.com/advisories/51812
https://exchange.xforce.ibmcloud.com/vulnerabilities/81398
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.