Vulnerability Details : CVE-2012-1621
Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request. NOTE: some of these details are obtained from third party information.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2012-1621
- cpe:2.3:a:apache:ofbiz:10.04.01:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-1621
7.79%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-1621
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2012-1621
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1621
-
http://seclists.org/bugtraq/2012/Apr/101
Bugtraq: [CVE-2012-1621] Apache OFBiz information disclosure vulnerabilityMailing List;Third Party Advisory
-
http://mail-archives.apache.org/mod_mbox/ofbiz-dev/201204.mbox/%3CA126EDA0-06A5-4B67-8CDD-FC5F5AABA147%40apache.org%3E
-
http://secunia.com/advisories/48800
Sign inThird Party Advisory
-
http://www.securityfocus.com/bid/53023
Apache OFBiz Multiple Cross Site Scripting VulnerabilitiesThird Party Advisory;VDB Entry
-
http://osvdb.org/show/osvdb/81347
Broken Link
-
http://mail-archives.apache.org/mod_mbox/www-announce/201204.mbox/%3C2B984C00-EC65-4455-98D3-55735ABE8AF9@apache.org%3E
[ANNOUNCE] Apache OFBiz 10.04.02 releasedVendor Advisory
-
http://osvdb.org/show/osvdb/81349
Broken Link
-
http://mail-archives.apache.org/mod_mbox/ofbiz-dev/201204.mbox/%3CA126EDA0-06A5-4B67-8CDD-FC5F5AABA147@apache.org%3E
[CVE-2012-1621] Apache OFBiz information disclosure vulnerabilityVendor Advisory
-
http://ofbiz.apache.org/download.html#vulnerabilities
The Apache OFBiz® Project - DownloadsVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/74870
Apache OFBiz multiple cross-site scripting CVE-2012-1621 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://seclists.org/fulldisclosure/2012/Apr/172
Full Disclosure: [CVE-2012-1621] Apache OFBiz information disclosure vulnerabilityMailing List;Third Party Advisory
-
http://osvdb.org/show/osvdb/81348
Broken Link
-
http://www.securitytracker.com/id?1026927
Apache OFBiz Input Validation Flaws Permit Cross-Site Scripting Attacks - SecurityTrackerThird Party Advisory;VDB Entry
-
http://osvdb.org/show/osvdb/81346
Broken Link
-
http://mail-archives.apache.org/mod_mbox/www-announce/201204.mbox/%3C2B984C00-EC65-4455-98D3-55735ABE8AF9%40apache.org%3E
Jump to