Apache OFBiz Nested Expression Remote Code Execution Vulnerability

Bugtraq ID:	61369
Class:	Input Validation Error
CVE:	CVE-2013-2250
Remote:	Yes
Local:	No
Published:	Jul 20 2013 12:00AM
Updated:	Jul 20 2013 12:00AM
Credit:	Grégory Draperi
Vulnerable:	Apache OfBiz 12.4.1 Apache OfBiz 11.4.2 Apache OfBiz 11.4.1 Apache OfBiz 10.4.5 Apache OfBiz 10.4.4 Apache OfBiz 10.4.3 Apache OfBiz 10.4.2 Apache OfBiz 10.4.1
Not Vulnerable:	Apache OfBiz 12.4.2 Apache OfBiz 11.4.3 Apache OfBiz 10.4.6

Apache OFBiz Nested Expression Remote Code Execution Vulnerability

Apache OFBiz is prone to a remote code-execution vulnerability.

A remote attacker can leverage this issue to execute arbitrary code within the context of the application.

The following products are vulnerable:

Apache OFBiz 10.04.01 through 10.04.05
Apache OFBiz 11.04.01 through 11.04.02
Apache OFBiz 12.04.01

Apache OFBiz Nested Expression Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache OFBiz Nested Expression Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache OFBiz Nested Expression Remote Code Execution Vulnerability

References:

• Apache OFBiz Homepage (Apache)
  
• Download Apache OFBiz (Apache)