CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the…

published December 13, 2018

CVSS
—
EPSS
26%
Percentile
98.0
In the wild
Unconfirmed
What it is

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.25743 · 98.0th percentile
Published
2018-12-13T14:00Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 26% → 60%
    epss
  • 06 SEP 03:12Z
    EPSS moved 26% → 60%
    epss
  • 30 AUG 16:01Z
    EPSS moved 60% → 26%
    epss
  • 29 AUG 04:42Z
    EPSS moved 26% → 60%
    epss
  • 13 DEC 14:00Z
    In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the…
    cvelistv5