cve.bz

CVE-2019-10074

9.8 criticalEPSS 3.4%

Critical (9.8) in apache ofbiz. EPSS 3.4% chance of exploitation in the next 30 days.

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWEs
CWE-74, CWE-116
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON