{"id":"CVE-2018-8033","published":"2018-12-13T14:00:00Z","modified":"2024-08-05T06:46:11Z","title":"In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles…","vendor":"Apache Software Foundation","product":"Apache OFBiz","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache OFBiz","versions":["Apache OFBiz 16.11.01 to 16.11.04"]}],"description":{"text":"In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache OFBiz versions 16.11.01 through 16.11.04 contain a flaw in the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java), which handles HTTP service requests at the /webtools/control/httpService endpoint. An attacker who can send crafted GET or POST requests to that endpoint, using the serviceName, serviceMode, and serviceContext parameters with DOCTYPE declarations that reference external entities, can cause the server to return secret information from the host.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:23Z"},"cvss":null,"epss":{"score":0.25743,"percentile":0.97966,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-09-29","exploitedFirstSeen":"2026-09-29","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2018-8033","date":"2026-09-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2018-8033","date":"2026-09-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-22&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-25&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-26&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-27&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-30&host_type=src&vulnerability=cve-2018-8033","date":"2026-10-30"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/e8fb551e86e901932081f81ee9985bb72052b4d412f23d89b1282777%40%3Cuser.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-19723","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-19723","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-04-24","earliestUrl":"https://github.com/Cappricio-Securities/CVE-2018-8033","repos":[{"name":"Cappricio-Securities/CVE-2018-8033","url":"https://github.com/Cappricio-Securities/CVE-2018-8033","stars":2,"created":"2024-04-24"}]},"nuclei":[{"id":"CVE-2018-8033","name":"Apache OFBiz - XML External Entity Injection","severity":"high","path":"http/cves/2018/CVE-2018-8033.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8033.yaml"}],"first":{"date":"2024-04-24","source":"PoC-in-GitHub","url":"https://github.com/Cappricio-Securities/CVE-2018-8033"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2018-12-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-8033","provenance":"source"},{"date":"2024-04-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Cappricio-Securities/CVE-2018-8033","provenance":"source"},{"date":"2026-09-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2018-8033","provenance":"source"}],"speed":{"daysToPublicExploit":1959,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 32 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.59,"detail":"percentile 0.9797"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}