CVE-2018-17200

🗓️ 11 Sep 2019 20:22:44Reported by apacheType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

Apache OFBiz HTTP engine vulnerability in handling HTTP requests

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2018-17200	12 Sep 201900:31	–	circl
Cvelist	CVE-2018-17200	11 Sep 201920:22	–	cvelist
EUVD	EUVD-2018-8964	7 Oct 202500:30	–	euvd
NVD	CVE-2018-17200	11 Sep 201921:15	–	nvd
Prion	Design/Logic Flaw	11 Sep 201921:15	–	prion
RedhatCVE	CVE-2018-17200	22 May 202512:47	–	redhatcve

NVD

Vulners

Node

apache ofbizRange16.11.01–16.11.05

[
  {
    "product": "OFBiz",
    "vendor": "Apache",
    "versions": [
      {
        "status": "affected",
        "version": "OFBiz 16.11.01 to 16.11.05"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E
s	www.s.apache.org/m9boi
lists	www.lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E

Parameter	Position	Path	Description	CWE
serviceContent	request body	/webtools/control/httpService	Insecure deserialization via XStream in Apache OFBiz HTTP engine endpoint, allowing attacker-controlled deserialization of crafted serviceContent.	CWE-502

21 Nov 2024 03:54Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.19.8

EPSS0.01989