High severity · published Nov 26, 2019
CVE-2011-3600
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that…
7.5
CVSS
15.9%
EPSS
No
On KEV
Description
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.9% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
16.11.01 through 16.11.04 · source: NVD, vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3600
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600
mail-archives.apache.org
http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E
access.redhat.com
https://access.redhat.com/security/cve/cve-2011-3600
lists.apache.org
https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E
security-tracker.debian.org
https://security-tracker.debian.org/tracker/CVE-2011-3600
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin