CVEvulnerability
CVE-2013-0177
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-01-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
Affected configurations
• apache ofbiz 09.04
• apache ofbiz 09.04.01
• apache ofbiz 10.04
• apache ofbiz 10.04.01
• apache ofbiz 10.04.02
• apache ofbiz 10.04.03
• apache ofbiz 10.04.04
• apache ofbiz 11.04.01
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://ofbiz.apache.org/download.html#vulnerabilities Vendor Advisory
- http://osvdb.org/89452 Broken Link
- http://osvdb.org/89453 Broken Link
- http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2013/Jan/148 Mailing List, Third Party Advisory
- http://secunia.com/advisories/51812 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81398 Third Party Advisory, VDB Entry
- https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395 Broken Link
- https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850 Broken Link
- http://ofbiz.apache.org/download.html#vulnerabilities Vendor Advisory
- http://osvdb.org/89452 Broken Link
- http://osvdb.org/89453 Broken Link
- http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2013/Jan/148 Mailing List, Third Party Advisory
- http://secunia.com/advisories/51812 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81398 Third Party Advisory, VDB Entry
- https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395 Broken Link
- https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850 Broken Link