#VU42096 Cross-site scripting in OFBiz - CVE-2013-0177
Vulnerability identifier: #VU42096
Vulnerability risk: Low
CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID:
CWE-ID:
CWE-79
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
OFBiz
Other software /
Other software solutions
Vendor: Apache Foundation
Description
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Mitigation
Install update from vendor's website.
Vulnerable software versions
OFBiz: 09.04 - 11.04.01
External links
https://ofbiz.apache.org/download.html#vulnerabilities
https://osvdb.org/89452
https://osvdb.org/89453
https://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html
https://seclists.org/fulldisclosure/2013/Jan/148
https://secunia.com/advisories/51812
https://exchange.xforce.ibmcloud.com/vulnerabilities/81398
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
