CVE-2017-15714

CWE-744 documents4 sources
Severity
9.8CRITICAL
EPSS
0.8%
top 25.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache OfbizApache Ofbiz
Timeline
PublishedJan 4
Latest updateMay 14

Description

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window would execute.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/ofbiz16.11.01, 16.11.02, 16.11.03+2
▶CVEListV5apache_software_foundation/apache_ofbiz16.11.01 to 16.11.03

🔴Vulnerability Details

2
GHSA
GHSA-rq9x-7hcg-78pm: The BIRT plugin in Apache OFBiz 16↗2022-05-14
▶
CVEList
CVE-2017-15714: The BIRT plugin in Apache OFBiz 16↗2018-01-04
▶

📋Vendor Advisories

1
Apache
Apache ofbiz: CVE-2017-15714↗
▶
CVE-2017-15714 (CRITICAL CVSS 9.8) | The BIRT plugin in Apache OFBiz 16. | cvebase.io