CVE-2020-9496: apache ofbiz Cross-site Scripting

EPSS trend

Probability

98.93%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 98.93% on 18-09-2026

18-09-202618-10-2026

EPSS score

98.93%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 5 exploits

exploit-databasejavaUnverified
ApacheOfBiz 17.12.01 - Remote Command Execution (RCE)
Maturity: poc
MetasploitremoteVerified
Apache OFBiz XML-RPC Java Deserialization
exploit/linux/http/apache_ofbiz_deserialization
Maturity: weaponized

References

10 links

s.apache.org/l0994X Refsource MISCMailing ListVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
packetstormsecurity.com/files/163730/Apache-OfBiz-17.12.01-Remote-Command-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry

Related vulnerabilities

CVE-2018-17200apacheofbiz5.03%7y ago11-09-2019 20:22The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019 CVE-2018-8033apache software foundationapache ofbiz+125.74%7y ago13-12-2018 14:00In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.CVE-2013-2250apacheofbiz12.37%13y ago15-08-2013 16:00Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.CVE-2013-2137apacheofbiz7.67%13y ago15-08-2013 16:00Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2013-0177apacheofbiz21.23%12y ago30-01-2014 15:00Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.CVE-2015-3268apacheofbiz9.18%10y ago12-04-2016 14:00Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.

All vulnerabilities inofbiz

CVE-2020-9496: apache ofbiz Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References