Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-11716

Apache OFBiz unsafe deserialization of XMLRPC arguments (CVE-2020-9496)

    XMLWordPrintableJSON

Details

    • Bug Crush Event - 21/2/2015

    Description

      Because the 2 xmlrpc related requets in webtools (xmlrpc and ping) are not using authentication they are vulnerable to unsafe deserialization.

      This issue was reported to the security team by Alvaro Munoz <pwntester@github.com> from the GitHub Security Lab team

      Attachments

        Issue Links

          relates to

          Sub-task - The sub-task of the issue OFBIZ-12332 post-auth Remote Code Execution Vulnerability

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Activity

            People

              jleroux Jacques Le Roux
              jleroux Jacques Le Roux
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: