CVE-2012-1621

medium Apache
CVSS v3 Base Score
4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS Score
6.1%
Exploitation probability in 30 days
Top 9% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
M
Confidentiality
None
Integrity
P
Availability
None
Published: June 19, 2014 (4347 days ago)
Last Modified: May 6, 2026
Vendor: Apache
Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request. NOTE: some of these details are obtained from third party information.

CWE

CWE-79

Affected Products

apache ofbiz

References

🔗 mail-archives.apache.org 🔗 mail-archives.apache.org 🔗 ofbiz.apache.org 🔗 osvdb.org 🔗 osvdb.org