Apache OFBiz EUVD-2026-30868

Exploitation requires a victim user with an active OFBiz session to click or follow a crafted URL containing the XSS payload - mandatory user interaction (UI:R) is the primary limiting factor. The attacker requires no authentication and no elevated privileges (PR:N) on the OFBiz instance. No special server-side configuration or non-default feature needs to be enabled; the flaw affects OFBiz's default web page generation behavior across all versions before 24.09.06. Exploitation is bounded by: (1) the requirement for victim interaction - mass unauthenticated automated exploitation without a social engineering vector is not possible per SSVC 'automatable: no'; (2) the need to target a specific authenticated user session to achieve meaningful impact beyond benign script injection; and (3) the impact ceiling of C:L/I:L, which limits what injected scripts can access within the browser's same-origin policy constraints.

The CVSS 6.1 Medium score is consistent with a standard reflected XSS: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), but constrained by mandatory user interaction (UI:R) and limited C:L/I:L impact. EPSS at 0.03% (8th percentile) places this well below the exploitation probability threshold that would warrant emergency response. SSVC reinforces this: exploitation is 'none,' the attack is not automatable (a victim must interact with a crafted payload), and technical impact is only partial. The combination of these signals indicates a genuine but non-urgent patching priority - this is not a 'high-CVSS-but-low-real-risk' case, nor is it a silent sleeper; it is a textbook medium-severity XSS with no current threat activity. Organizations running OFBiz internet-facing with active authenticated user sessions represent the highest-risk deployment profile. No conflicting signals between CVSS, EPSS, and SSVC were identified.

An attacker identifies an OFBiz endpoint that reflects unsanitized query parameters back into a web page and crafts a URL embedding a JavaScript payload (e.g., a cookie-stealing script). The attacker distributes this URL via phishing email to OFBiz users; when a logged-in user clicks the link, the script executes in their browser, exfiltrating the session cookie to an attacker-controlled server and enabling full session takeover within the OFBiz ERP environment. No public exploit code has been identified at time of analysis, but AC:L and PR:N indicate low barrier to manual exploitation once a vulnerable endpoint is identified.