CVE-2011-3600
- State
- Published
- Severity
- Not scored
- Published
- Nov 26, 2019
- Updated
- Aug 6, 2024
- Reserved
- Sep 21, 2011
Description
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
OFBizOFBiz |
|
References
- https://security-tracker.debian.org/tracker/CVE-2011-3600
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600
- https://access.redhat.com/security/cve/cve-2011-3600
- https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E
- http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.