vulnwire
9.8crit

CVE-2016-2170in critical feed

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted seriali…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
12.7%
percentile 96%
Public exploits
0
none known

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Exploit prediction (EPSS)

12.68% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • ofbiz.apache.org /download.html#vulnerabilities · x_refsource_CONFIRM, x_transferred
  • blogs.apache.org /ofbiz/entry/announce_apache_ofbiz_12_04 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1035513 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • issues.apache.org /jira/browse/OFBIZ-6726 · x_refsource_CONFIRM, x_transferred
  • cwiki.apache.org /confluence/display/OFBIZ/The+infamous+Java+serialization+vulnerability · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /archive/1/538034/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • blogs.apache.org /ofbiz/entry/announce_apache_ofbiz_13_07 · x_refsource_CONFIRM, x_transferred
  • packetstormsecurity.com /files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html · x_refsource_MISC, x_transferred
  • lists.apache.org /thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6%40%3Cdev.ofbiz.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a%40%3Cdev.ofbiz.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.