OFBiz Unspecified HTML Injection Vulnerability

Bugtraq ID:	21529
Class:	Input Validation Error
CVE:	CVE-2006-6587
Remote:	Yes
Local:	No
Published:	Nov 15 2006 12:00AM
Updated:	Dec 22 2006 12:03AM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	Apache OfBiz 3.0.0
Not Vulnerable:

OFBiz Unspecified HTML Injection Vulnerability

OFBiz is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Specific details about this issue are currently unavailable at this moment. This BID will be updated when more information becomes available.

OFBiz Unspecified HTML Injection Vulnerability

An attacker can exploit this issue through a web client.

OFBiz Unspecified HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

OFBiz Unspecified HTML Injection Vulnerability

References:

• OsBiz Home Page (Apache Software Foundation)