In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles…
Apache Software Foundation · Apache OFBiz
Apache OFBiz versions 16.11.01 through 16.11.04 contain a flaw in the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java), which handles HTTP service requests at the /webtools/control/httpService endpoint. An attacker who can send crafted GET or POST requests to that endpoint, using the serviceName, serviceMode, and serviceContext parameters with DOCTYPE declarations that reference external entities, can cause the server to return secret information from the host.
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 8 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 years after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+5 yrs
- First seen exploitedVulnCheck KEV evidence+8 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.