Unscored severity · published Aug 15, 2013
CVE-2013-2137
Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01…
–
CVSS
7.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
10.04.01; 10.04.02; 10.04.03; 10.04.04; 10.04.05; 11.04.01; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2137
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2013-07/0144.html
Patch
http://ofbiz.apache.org/download.html#vulnerabilities
Broken Link
http://osvdb.org/95523
Third Party Advisory
http://secunia.com/advisories/53910
Third Party Advisory
http://www.securityfocus.com/bid/61370
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85874
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin