apache ofbiz CVE-2019-0189 is a vulnerability in Apache OFBiz
Published on September 11, 2019

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16

NVD


Products Associated with CVE-2019-0189

Want to know whenever a new CVE is published for Apache OFBiz? stack.watch will email you.

Apache OFBiz
 

Affected Versions

Apache OFBiz Version OFBiz 16.11.01 to 16.11.05 is affected by CVE-2019-0189

Exploit Probability

EPSS
30.51%
Percentile
96.60%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.