The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: apache
Published: 2019-09-11T20:29:24
Updated: 2020-05-02T12:06:01
Reserved: 2018-11-14T00:00:00
Link: CVE-2019-0189
JSON object: View
NVD Information
Status : Modified
Published: 2019-09-11T21:15:10.953
Modified: 2023-11-07T03:01:47.110
Link: CVE-2019-0189
JSON object: View
Redhat Information
No data.
CWE