CVE-2013-0177
published 2014-01-30CVE-2013-0177: Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before…
PriorityP424low3.5CVSS 2.0
AVNACMAuSCNIPAN
EXPLOIT
EPSS
21.23%
97.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
| apache | ofbiz | — | — |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_apache3.5LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache ofbiz: CVE-2013-0177
vendor_apache·CVSS 3.5
CVE-2013-0177 [LOW] Apache ofbiz: CVE-2013-0177
Apache ofbiz: CVE-2013-0177
; affected releases: 11.04.01, 10.04.04 and earlier versions (10.04.*); fixed in 11.04.02 and 10.04.05
GHSA
GHSA-w9c3-p3j8-wq65: Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget
ghsa_unreviewed·2022-05-05
CVE-2013-0177 [LOW] CWE-79 GHSA-w9c3-p3j8-wq65: Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
No detection rules found.
No writeups or analysis indexed.
http://ofbiz.apache.org/download.html#vulnerabilitieshttp://osvdb.org/89452http://osvdb.org/89453http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.htmlhttp://seclists.org/fulldisclosure/2013/Jan/148http://secunia.com/advisories/51812https://exchange.xforce.ibmcloud.com/vulnerabilities/81398https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850http://ofbiz.apache.org/download.html#vulnerabilitieshttp://osvdb.org/89452http://osvdb.org/89453http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.htmlhttp://seclists.org/fulldisclosure/2013/Jan/148http://secunia.com/advisories/51812https://exchange.xforce.ibmcloud.com/vulnerabilities/81398https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850
2014-01-30
Published