Apache OFBiz up to 16.11.05 Form Widget Freemarker Markup input validation

Summaryinfo

A vulnerability marked as critical has been reported in Apache OFBiz up to 16.11.05. This affects an unknown part of the component Form Widget. This manipulation as part of Freemarker Markup causes input validation. The identification of this vulnerability is CVE-2019-10074. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache OFBiz up to 16.11.05. It has been declared as critical. Affected by this vulnerability is an unknown code of the component Form Widget. The manipulation as part of a Freemarker Markup leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

The weakness was shared 09/11/2019 (Website). The advisory is shared at s.apache.org. This vulnerability is known as CVE-2019-10074 since 03/26/2019. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 16.11.06 eliminates this vulnerability.

The entries VDB-141648, VDB-141646 and VDB-141647 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Apache

Name

• OFBiz

Version

• 16.11.05

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion