Apache OFBiz - XML External Entity Injection Detection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CVE-2019-0189

The CVE-2019-0189 issue affects Apache OFBiz via two dependencies (commons-beanutils and an outdated commons-fileupload). It uses Java deserialization in the HttpEngine: the request parameter serviceContext is passed to XmlSerializer.deserialize, enabling remote code execution through java.io.Obj...

PT-2019-11182

Name of the Vulnerable Software and Affected Versions: Apache Ofbiz versions prior to 16.11.06 Description: The issue is related to Java serialisation problems caused by the java.io.ObjectInputStream. It is exposed through the "webtools/control/httpService" URL and uses Java deserialization for...