What’s Vulnerable › Vulnerabilities
CVE-2020-1943
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 97.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-04-01 · updated 2026-06-17
- Weakness: CWE-79
Description
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
Affected products
- Apache Software Foundation Apache OFBiz: from 16.11.01 through 16.11.07
References
- https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757%40%3Cdev.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ra6c011af63d8a8cd8c0b8f72b2b0c392af4d5ed040ba59be344d13fa%40%3Cdev.ofbiz.apache.org%3E
- https://s.apache.org/pr5u8
- https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757%40%3Cdev.ofbiz.apache.org%3E
- https://lists.apache.org/thread.html/ra6c011af63d8a8cd8c0b8f72b2b0c392af4d5ed040ba59be344d13fa%40%3Cdev.ofbiz.apache.org%3E
- https://s.apache.org/pr5u8
Get alerted when CVE-2020-1943 or the next vulnerability affects your stack