EUVD-2026-30868
GHSA-6hh7-r867-mmv2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requires no auth but mandates victim interaction (UI:R); injected script crosses into browser context (S:C) with limited cookie/DOM impact (C:L/I:L) and no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
AnalysisAI
Cross-site scripting in Apache OFBiz before version 24.09.06 allows remote unauthenticated attackers to inject malicious scripts into web pages rendered in victims' browsers, enabling session hijacking, credential theft, or unauthorized ERP actions performed on behalf of the victim. The CVSS scope change (S:C) confirms the injected script escapes the OFBiz application context and executes in the victim's browser security domain. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS sits at 0.03% (8th percentile), and no public exploit code is referenced; however, a vendor-released patch to version 24.09.06 is available and should be applied.
Technical ContextAI
Apache OFBiz is an open-source Java-based Enterprise Resource Planning (ERP) framework covering order management, accounting, and manufacturing workflows. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input reaches the HTTP response without adequate sanitization or output encoding, allowing an attacker to embed arbitrary JavaScript or HTML. The CVSS vector's Scope:Changed metric confirms the injected code executes outside OFBiz's own security domain - in the victim's browser context - which is the defining characteristic of a classic reflected or stored XSS. The CPE string cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:* covers all OFBiz releases across all platforms up to the fix boundary.
RemediationAI
Upgrade Apache OFBiz to version 24.09.06 or later, which resolves this issue per the vendor advisory at https://lists.apache.org/thread/1fblqdo89d3ps8kgtcnkcq8sh7gwkcpn. If immediate patching is not feasible, deploy a Web Application Firewall with XSS filtering rules targeting OFBiz endpoints; note that WAF rules require tuning to avoid false positives on legitimate OFBiz form submissions. Implementing strict Content Security Policy (CSP) response headers (specifically default-src 'self' and script-src without 'unsafe-inline') will significantly reduce the impact of any injected script by preventing inline execution and restricting external script loading - this is an effective compensating control but does not eliminate the underlying injection flaw. For public-facing deployments, consider restricting access to OFBiz web endpoints by IP allowlist to limit the attacker's ability to deliver the payload, accepting the trade-off of reduced accessibility.
More in Apache Ofbiz
View allRemote code execution in Apache OFBiz before 24.09.06 stems from an improper authentication flaw in the password-change
LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into
Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic k
Authenticated code injection in Apache OFBiz versions prior to 24.09.06 allows remote attackers with low-privileged acco
Information disclosure in Apache OFBiz before 24.09.06 lets remote unauthenticated attackers retrieve sensitive data the
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server
Improper input validation in Apache OFBiz before 24.09.06 allows unauthenticated remote attackers to achieve partial con
Code injection in Apache OFBiz's email services exposes all versions before 24.09.06 to unauthenticated remote exploitat
Expression Language Injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject and eval
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Cust
Path traversal in Apache OFBiz before 24.09.06 exposes unauthenticated remote attackers to file read and limited file wr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today