VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Sep 11, 2019· Updated Jun 17, 2026

CVE-2019-10074

CVE-2019-10074

Description

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

Affected products

3
  • Apache/Ofbizv53 versions
    OFBiz 16.11.01 to 16.11.05+ 2 more
    • (no CPE)range: OFBiz 16.11.01 to 16.11.05
    • cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*range: >=16.11.01,<=16.11.05
    • (no CPE)range: before 16.11.06

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.