vulnwire
9.8crit

CVE-2019-0189in critical feed

The java.io.ObjectInputStream is known to cause Java serialisation issues.

Published 7 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
23.7%
percentile 98%
Public exploits
0
none known

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16

Exploit prediction (EPSS)

23.71% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Apache OFBiz

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

  • s.apache.org /hsn2g · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/7316b4fa811e1ec27604cda3c30560e7389fc6b8c91996c9640fabb8%40%3Cnotifications.o · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/986ed5f1a0e209f87ed4a2d348ae5735054f9188912bb2fed7a5543f%40%3Cnotifications.o · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r11fd9562dbdfc0be95e40518cbef70ab2565129f6f542a870ab82c69%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/ref1b535d7bd5423bfb456cd05aa41e52875390cdfc6ae7c50397ead6%40%3Ccommits.ofbiz. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r883840bbb4e2366acd0f6477e86b584000900a270a86587f979a55f9%40%3Ccommits.ofbiz. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rb0e716837168dc1073fcd76bea644806e5337c247fdb5d8c243d41f8%40%3Ccommits.ofbiz. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/re4623c0fec904882cbbf8cda558f88c1857397fb5c35761bc12a78bd%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rc0a839fe38d3de775f62e39d45af91870950b59688b64ab61ecc080e%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r2c2db313ac9a43f1cfbd01092e4acb0b8bd38d90091889236ad827e7%40%3Cnotifications. · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.