title: Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
description:
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10.
Users are recommended to upgrade to version 18.12.10
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
defaultStatus: affected
product: Apache OFBiz
vendor: Apache Software Foundation
versions:
lessThan: 18.12.10, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]