CVE-2011-3600

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
OFBiz	OFBiz	16.11.01 to 16.11.04

References

http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E
https://access.redhat.com/security/cve/cve-2011-3600Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600Issue Tracking, Patch, Third Party Advisory
https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2011-3600Third Party Advisory
http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E
https://access.redhat.com/security/cve/cve-2011-3600Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600Issue Tracking, Patch, Third Party Advisory
https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2011-3600Third Party Advisory

Timeline

Published: Nov 26, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-36017.5Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitr CVE-2011-36026.4Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite CVE-2011-36034.4The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd da CVE-2011-36047.5The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-CVE-2011-36055.0The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cau CVE-2011-36065.4A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attac CVE-2011-36074.4Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when t CVE-2011-36096.5A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console informat CVE-2011-36106.1A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendi CVE-2011-36117.2A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.CVE-2011-36128.8Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.CVE-2011-36137.5An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.