{"schemaVersion":3,"id":"CVE-2013-0177","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.","dates":{"published":"2014-01-30T15:00:00.000Z","modified":"2024-08-06T14:18:09.106Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.5,"severity":"low","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.5,"severity":"low","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.2123,"percentile":0.97568,"severity":"high","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.2123},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.2123,"percentile":0.97568}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.2123,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.2123,"percentile":0.97568}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"38230","name":"Apache OFBiz 10.4.x - Multiple Cross-Site Scripting Vulnerabilities","source":"exploit-database","url":"https://www.exploit-db.com/exploits/38230","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/38230.txt","codes":["CVE-2013-0177","OSVDB-89453","OSVDB-89452"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"apache","product":"ofbiz","name":"ofbiz","label":"ofbiz","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"09.04","noFixRecorded":false,"fixedIn":null},{"text":"09.04.01","noFixRecorded":false,"fixedIn":null},{"text":"10.04","noFixRecorded":false,"fixedIn":null},{"text":"10.04.01","noFixRecorded":false,"fixedIn":null},{"text":"10.04.02","noFixRecorded":false,"fixedIn":null},{"text":"10.04.03","noFixRecorded":false,"fixedIn":null},{"text":"10.04.04","noFixRecorded":false,"fixedIn":null},{"text":"11.04.01","noFixRecorded":false,"fixedIn":null}],"versionsText":"09.04 | 09.04.01 | 10.04 | 10.04.01 | 10.04.02 | 10.04.03 | 10.04.04 | 11.04.01","eol":null,"hubHref":"/vendor/apache/ofbiz"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://osvdb.org/89453","label":"osvdb.org/89453","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://ofbiz.apache.org/download.html#vulnerabilities","label":"ofbiz.apache.org/download.html","hostname":"ofbiz.apache.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2013/Jan/148","label":"seclists.org/fulldisclosure/2013/Jan/148","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://osvdb.org/89452","label":"osvdb.org/89452","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html","label":"packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395","label":"fisheye6.atlassian.com/changelog/ofbiz?cs=1432395","hostname":"fisheye6.atlassian.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/81398","label":"exchange.xforce.ibmcloud.com/vulnerabilities/81398","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://secunia.com/advisories/51812","label":"secunia.com/advisories/51812","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850","label":"fisheye6.atlassian.com/changelog/ofbiz?cs=1432850","hostname":"fisheye6.atlassian.com","tags":["X Refsource CONFIRM","Broken Link"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2014-01-30T15:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T14:18:09.106Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:54:38.969Z","stale":false,"partial":false}}