CVE-2020-1943 Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07

Description

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

Affected products and versions

Product	Affected versions	Fixed in
Apache OFBiz	Versions not published

Other CVEs of Apache OFBiz

The 4 CVEs of Apache OFBiz →

CVE-2019-0235 Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks Not rated CVE-2019-12425 Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host Not rated CVE-2019-12426 an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache… Not rated