Vulnerability Details : CVE-2020-9496

Public exploit exists!
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
Published 2020-07-15 16:15:12
Updated 2022-04-05 15:06:30
Source Apache Software Foundation
View at NVD,   CVE.org
Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2020-9496

Exploit prediction scoring system (EPSS) score for CVE-2020-9496

EPSS FAQ
86.72%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-9496

  • Apache OFBiz XML-RPC Java Deserialization
    Disclosure Date: 2020-07-13
    First seen: 2021-03-12
    exploit/linux/http/apache_ofbiz_deserialization
    This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.01 using the ROME gadget chain. Versions up to 18.12.11 are exploitable utilizing an auth bypass
  • Apache OFBiz XML-RPC Java Deserialization
    Disclosure Date: 2020-07-13
    First seen: 2020-08-17
    exploit/linux/http/apache_ofbiz_deserialiation
    exploit/linux/http/apache_ofbiz_deserialiation This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.04.

CVSS scores for CVE-2020-9496

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.3
 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N
8.6
2.9
 NIST
6.1
 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2.8
2.7
 NIST

CWE ids for CVE-2020-9496

References for CVE-2020-9496

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close