VulnCheck KEV: CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the IP address validation process. An attacker can access internal network resources by submitting specially crafted IPv4-mapped IPv6 literals to bypass reserved IP checks. Remediation Upgrade...

com.yammer.dropwizard:dropwizard-client (0.1.0), com.yammer.dropwizard:dropwizard-core (0.1.0) +69 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (7.6.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.0 - com.yammer.dropwizard:dropwizard-core 0.1.0 -...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

com.github.stephenc.jetties:jetty-deb (8.1.6), com.github.stephenc.jetties:jetty-rpm (8.1.6) +50 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (8.1.6.v20120903)

org.eclipse.jetty:jetty-server MAVEN version 8.1.6.v20120903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.github.stephenc.jetties:jetty-deb 8.1.6 - com.github.stephenc.jetties:jetty-rpm 8.1.6...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.1), org.eclipse.jetty.aggregate:jetty-all (7.6.2.v20120308) +53 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (7.6.2.v20120308)

org.eclipse.jetty:jetty-server MAVEN version 7.6.2.v20120308 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.1 -...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.1), org.eclipse.jetty.aggregate:jetty-all (7.6.2.v20120308) +53 more potentially affected by CVE-2011-4461 via org.eclipse.jetty:jetty-server (7.6.2.v20120308)

org.eclipse.jetty:jetty-server MAVEN version 7.6.2.v20120308 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.1 -...

com.github.stephenc.jetties:jetty-deb (8.1.6), com.github.stephenc.jetties:jetty-rpm (8.1.6) +50 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.1.6.v20120903)

org.eclipse.jetty:jetty-server MAVEN version 8.1.6.v20120903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.github.stephenc.jetties:jetty-deb 8.1.6 - com.github.stephenc.jetties:jetty-rpm 8.1.6...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

CVE-2019-0189

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the...

Design/Logic Flaw

The Apache OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the serviceContent parameter in the request and deserializes it using XStream. This XStream instance is slightly guard...

CVE-2019-0189

The CVE-2019-0189 issue affects Apache OFBiz via two dependencies (commons-beanutils and an outdated commons-fileupload). It uses Java deserialization in the HttpEngine: the request parameter serviceContext is passed to XmlSerializer.deserialize, enabling remote code execution through java.io.Obj...

PT-2019-11182

Name of the Vulnerable Software and Affected Versions: Apache Ofbiz versions prior to 16.11.06 Description: The issue is related to Java serialisation problems caused by the java.io.ObjectInputStream. It is exposed through the "webtools/control/httpService" URL and uses Java deserialization for...

PT-2019-4335

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 16.11.06 Description The issue exists due to insufficient input validation in the Apache OFBiz HTTP engine, specifically in the org.apache.ofbiz.service.engine.HttpEngine.java component. This allows a remote...

com.xuxueli:xxl-job-core (>=1.4.1, <=1.5.0), org.eclipse.jetty.aggregate:jetty-all (7.6.19.v20160209) +38 more potentially affected by CVE-2019-10241 via org.eclipse.jetty:jetty-server (7.6.19.v20160209)

org.eclipse.jetty:jetty-server MAVEN version 7.6.19.v20160209 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.xuxueli:xxl-job-core =1.4.1, =1.5.0 - org.eclipse.jetty.aggregate:jetty-all...

com.yammer.dropwizard:dropwizard-client (0.2.1), com.yammer.dropwizard:dropwizard-core (0.2.1) +53 more potentially affected by CVE-2019-10241 via org.eclipse.jetty:jetty-server (7.6.1.v20120215)

org.eclipse.jetty:jetty-server MAVEN version 7.6.1.v20120215 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.2.1 - com.yammer.dropwizard:dropwizard-core 0.2...

CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

com.hazelcast:hazelcast-jetty7-sessionmanager (>=1.0, <=1.0.2), org.akhikhl.gretty:gretty-runner-jetty7 (>=1.1.9, <=2.0.0) +52 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.16.v20140903)

org.eclipse.jetty:jetty-server MAVEN version 7.6.16.v20140903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.hazelcast:hazelcast-jetty7-sessionmanager =1.0, =1.1.9, =1.4.10, =1.4.14 -...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

com.rexsl:rexsl-maven-plugin (>=0.2, <=0.13.3), com.rexsl:rexsl-standalone (>=0.3.8, <=0.13.3) +43 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (8.0.2.v20111006)

org.eclipse.jetty:jetty-server MAVEN version 8.0.2.v20111006 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.rexsl:rexsl-maven-plugin =0.2, =0.3.8, =0.13.3 - org.eclipse.jetty.aggregate:jetty-al...