CVEvulnerability
CVE-2015-3268
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.
Affected configurations
• apache ofbiz 12.04.01
• apache ofbiz 12.04.02
• apache ofbiz 12.04.03
• apache ofbiz 12.04.04
• apache ofbiz 12.04.05
• apache ofbiz 13.07.01
• apache ofbiz 13.07.02
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://ofbiz.apache.org/download.html#vulnerabilities Patch, Vendor Advisory
- http://packetstormsecurity.com/files/136638/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html packetstormsecurity.com
- http://www.securityfocus.com/archive/1/538033/100/0/threaded www.securityfocus.com
- http://www.securitytracker.com/id/1035514 www.securitytracker.com
- https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04 blogs.apache.org
- https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07 Patch, Vendor Advisory
- https://issues.apache.org/jira/browse/OFBIZ-6506 issues.apache.org
- http://ofbiz.apache.org/download.html#vulnerabilities Patch, Vendor Advisory
- http://packetstormsecurity.com/files/136638/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html packetstormsecurity.com
- http://www.securityfocus.com/archive/1/538033/100/0/threaded www.securityfocus.com
- http://www.securitytracker.com/id/1035514 www.securitytracker.com
- https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04 blogs.apache.org
- https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07 Patch, Vendor Advisory
- https://issues.apache.org/jira/browse/OFBIZ-6506 issues.apache.org