Medium severity · published Apr 12, 2016
CVE-2015-3268
Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows…
6.1
CVSS
9.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)9.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
12.04.01; 12.04.02; 12.04.03; 12.04.04; 12.04.05; 13.07.01; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3268
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3268
Patch
http://ofbiz.apache.org/download.html#vulnerabilities
packetstormsecurity.com
http://packetstormsecurity.com/files/136638/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/538033/100/0/threaded
www.securitytracker.com
http://www.securitytracker.com/id/1035514
blogs.apache.org
https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04
Patch
https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin