{"containers": {"cna": {"affected": [{"product": "Apache OFBiz", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "16.11.01 to 16.11.03"}]}], "datePublic": "2018-01-03T00:00:00", "descriptions": [{"lang": "en", "value": "The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code \"__format=%27;alert(%27xss%27)\" to the URL an alert window would execute."}], "problemTypes": [{"descriptions": [{"description": "Arbitrary Code Execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T14:57:01", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "[user] 20180103 [SECURITY] CVE-2017-15714 Apache OFBiz BIRT code vulnerability", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://s.apache.org/UO3W"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "DATE_PUBLIC": "2018-01-03T00:00:00", "ID": "CVE-2017-15714", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache OFBiz", "version": {"version_data": [{"version_value": "16.11.01 to 16.11.03"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code \"__format=%27;alert(%27xss%27)\" to the URL an alert window would execute."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Arbitrary Code Execution"}]}]}, "references": {"reference_data": [{"name": "[user] 20180103 [SECURITY] CVE-2017-15714 Apache OFBiz BIRT code vulnerability", "refsource": "MLIST", "url": "https://s.apache.org/UO3W"}]}}}}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2017-15714", "datePublished": "2018-01-03T00:00:00", "dateReserved": "2017-10-21T00:00:00", "dateUpdated": "2018-01-04T14:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:ofbiz:16.11.01:*:*:*:*:*:*:*", "matchCriteriaId": "21851FFA-CEEF-48E4-8DF6-75A28009A481", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:ofbiz:16.11.02:*:*:*:*:*:*:*", "matchCriteriaId": "3B4C50A5-8B45-4627-8D41-74E181A54B33", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:ofbiz:16.11.03:*:*:*:*:*:*:*", "matchCriteriaId": "7BCB8B08-4BC5-487C-A706-A722BB5B430C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code \"__format=%27;alert(%27xss%27)\" to the URL an alert window would execute."}, {"lang": "es", "value": "El plugin BIRT en Apache OFBiz de la versi\u00f3n 16.11.01 a la 16.11.03 no escapa la propiedad de la entrada de usuario pasada. Esto permite que se inyecte c\u00f3digo pasando ese c\u00f3digo a trav\u00e9s de una URL. Por ejemplo, adjuntando este c\u00f3digo \"__format=%27;alert(%27xss%27)\" a la URL se ejecuta una ventana de alerta."}], "id": "CVE-2017-15714", "lastModified": "2018-01-24T19:03:21.660", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-04T15:29:00.210", "references": [{"source": "security@apache.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://s.apache.org/UO3W"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}