Unrated severityNVD Advisory· Published Sep 11, 2019· Updated Aug 5, 2024
CVE-2018-17200
CVE-2018-17200
Description
The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the serviceContent parameter in the request and deserializes it using XStream. This XStream instance is slightly guarded by disabling the creation of ProcessBuilder. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019
Affected products
2Patches
Vulnerability mechanics
References
5- lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3Emitremailing-listx_refsource_MLIST
- lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3Emitremailing-listx_refsource_MLIST
- lists.apache.org/thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz.apache.org%3Emitremailing-listx_refsource_MLIST
- lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3Emitremailing-listx_refsource_MLIST
- s.apache.org/m9boimitremailing-listx_refsource_MLIST
News mentions
0No linked articles in our index yet.