CVE-2019-10074 : An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been di

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

Published 2019-09-11 21:15:11

Updated 2021-07-21 11:39:24

Source Apache Software Foundation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-10074

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10074

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-10074

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-10074

https://s.apache.org/r49vw

[CVE-2019-10074] Apache OFBiz RCE (template injection) - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2@%3Cnotifications.ofbiz.apache.org%3E

[jira] [Updated] (OFBIZ-11006) Create customer request screen breaks when entering special characters (CVE-2019-10074) - Pony Mail
Mailing List;Vendor Advisory

Products affected by CVE-2019-10074

Apache » Ofbiz
Versions from including (>=) 16.11.01 and up to, including, (<=) 16.11.05
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2019-10074

Exploit prediction scoring system (EPSS) score for CVE-2019-10074

CVSS scores for CVE-2019-10074

CWE ids for CVE-2019-10074

References for CVE-2019-10074

Products affected by CVE-2019-10074