Apache OFBiz - Multiple Cross-Site Scripting

CVE编号

CVE-2010-0432

利用情况

暂无

补丁情况

N/A

披露时间

2010-04-16

漏洞描述

Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://svn.apache.org/viewvc?view=revision&revision=920369
http://svn.apache.org/viewvc?view=revision&revision=920370
http://svn.apache.org/viewvc?view=revision&revision=920371
http://svn.apache.org/viewvc?view=revision&revision=920372
http://svn.apache.org/viewvc?view=revision&revision=920379
http://svn.apache.org/viewvc?view=revision&revision=920380
http://svn.apache.org/viewvc?view=revision&revision=920381
http://svn.apache.org/viewvc?view=revision&revision=920382
http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xs...
http://www.securityfocus.com/bid/39489

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	apache	ofbiz	*		Up to (including) 09.04

CVSS3评分 4.3

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 无
• 影响范围 N/A
• 用户交互 需要
• 可用性 无
• 保密性 无
• 完整性 部分地

AV:N/AC:M/Au:N/C:N/I:P/A:N CWE-ID 漏洞类型 CWE-79 在Web页面生成时对输入的转义处理不恰当（跨站脚本）