Apache OFBiz <=16.11.07 - Cross-Site Scripting

披露于 2020/04/01 · 更新于 2025/07/31

CVSS 评分6.1/ 10.0

EPSS 概率86.3%百分位 99.3%

漏洞描述

Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 OFBiz 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2011-3600 Apache OFBiz - XML External Entity Injection OFBiz	高危	—	—	PoCEXP	2026/01/14
CVE-2024-45195 Apache OFBiz - Remote Code Execution OFBiz	高危	7.5	94.1%	PoCEXP	2024/09/05
CVE-2024-45507RCE Apache OFBiz - Remote Code Execution OFBiz	严重	9.8	87.6%	PoCEXP	2024/08/15
CVE-2024-38856 Apache OFBiz - Remote Code Execution OFBiz	严重	9.8	94.4%	PoCEXP	2024/06/20
CVE-2024-36104 Apache OFBiz - Path Traversal OFBiz	严重	9.1	93.6%	PoCEXP	2024/06/04
CVE-2024-32113RCE Apache OFBiz Directory Traversal - Remote Code Execution OFBiz	高危	9.8	93.5%	PoCEXP	2024/05/08