Unscored severity · published Jan 30, 2014
CVE-2013-0177
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and…
–
CVSS
21.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
Exploitation
Is it being used?
Exploit prediction (EPSS)21.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
09.04; 09.04.01; 10.04; 10.04.01; 10.04.02; 10.04.03; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0177
Vendor Advisory
http://ofbiz.apache.org/download.html#vulnerabilities
Broken Link
http://osvdb.org/89452
Broken Link
http://osvdb.org/89453
Third Party Advisory
http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html
Mailing List
http://seclists.org/fulldisclosure/2013/Jan/148
Third Party Advisory
http://secunia.com/advisories/51812
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin