CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable…

published November 26, 2019

CVSS
—
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.15910 · 96.9th percentile
Published
2019-11-26T00:07Z
EPSS history
Timeline
  • 26 NOV 00:07Z
    The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable…
    cvelistv5