Security Advisory

CVE-2017-15714

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-01-04 15:00:00

Last updated 2024-09-16 22:31:04

Assigner apache

CVSS score not scored

State PUBLISHED

Description

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window would execute.

← Browse all CVEs View on cve.org ↗