CVE-2019-12425

EPSS 2.18%
Published 30.04.2020 20:15:12
Last modified 21.11.2024 04:22:48
Source security@apache.org
Teams watchlist Login
Open Login

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host

Affected products Warnungen 0 Metrics 3 CWE 1 References 8

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Ofbiz Version17.12.01

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	2.18%	0.837

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E

https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E

https://lists.apache.org/thread.html/r5181b36218225447d3ce70891eeccfb6d6885309dffd7e0e59091817%40%3Cuser.ofbiz.apache.org%3E

https://lists.apache.org/thread.html/r907ce90745b52d2d5b6a815de03fd1d5f3831ab579a81d70cfda6f3d%40%3Cuser.ofbiz.apache.org%3E

https://s.apache.org/7sr1x

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2019-12425

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-12425

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12425

EUVD