CVE-2019-0189

🗓️ 11 Sep 2019 20:29:24Reported by apacheType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2019-0189	12 Sep 201900:31	–	circl
Check Point Advisories	Apache OFBiz Insecure Deserialization (CVE-2019-0189)	8 Apr 202000:00	–	checkpoint_advisories
Cvelist	CVE-2019-0189	11 Sep 201920:29	–	cvelist
NVD	CVE-2019-0189	11 Sep 201921:15	–	nvd
OSV	CVE-2019-0189	11 Sep 201921:15	–	osv
Prion	Deserialization of untrusted data	11 Sep 201921:15	–	prion
RedhatCVE	CVE-2019-0189	22 May 202510:04	–	redhatcve

NVD

Vulners

Node

apache ofbizRange16.11.01–16.11.06

[
  {
    "product": "OFBiz",
    "vendor": "Apache",
    "versions": [
      {
        "status": "affected",
        "version": "OFBiz 16.11.01 to 16.11.05"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/rc0a839fe38d3de775f62e39d45af91870950b59688b64ab61ecc080e%40%3Cnotifications.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/ref1b535d7bd5423bfb456cd05aa41e52875390cdfc6ae7c50397ead6%40%3Ccommits.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/r11fd9562dbdfc0be95e40518cbef70ab2565129f6f542a870ab82c69%40%3Cnotifications.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/re4623c0fec904882cbbf8cda558f88c1857397fb5c35761bc12a78bd%40%3Cnotifications.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/7316b4fa811e1ec27604cda3c30560e7389fc6b8c91996c9640fabb8%40%3Cnotifications.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/986ed5f1a0e209f87ed4a2d348ae5735054f9188912bb2fed7a5543f%40%3Cnotifications.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/r2c2db313ac9a43f1cfbd01092e4acb0b8bd38d90091889236ad827e7%40%3Cnotifications.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E
lists	www.lists.apache.org/thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz.apache.org%3E

Parameter	Position	Path	Description	CWE
serviceContext	query param	webtools/control/httpService	Java deserialization via XmlSerializer in HttpEngine leading to code execution (CWE-502) in Apache OFBiz via webtools/control/httpService.	CWE-502

21 Nov 2024 04:16Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

EPSS0.15419