CVE-2013-0177

LowCVSS 3.5/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ofbiz.apache.org/download.html#vulnerabilitiesVendor Advisory
http://osvdb.org/89452Broken Link
http://osvdb.org/89453Broken Link
http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2013/Jan/148Mailing List, Third Party Advisory
http://secunia.com/advisories/51812Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/81398Third Party Advisory, VDB Entry
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395Broken Link
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850Broken Link
http://ofbiz.apache.org/download.html#vulnerabilitiesVendor Advisory
http://osvdb.org/89452Broken Link
http://osvdb.org/89453Broken Link
http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2013/Jan/148Mailing List, Third Party Advisory
http://secunia.com/advisories/51812Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/81398Third Party Advisory, VDB Entry
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395Broken Link
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850Broken Link

Timeline

Published: Jan 30, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-01785.5Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.CVE-2013-01791.8The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows rem CVE-2013-01805.5Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.CVE-2013-01812.6Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certai CVE-2013-01825.0The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read ar CVE-2013-01835.0multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumpti CVE-2013-01844.3Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x befor CVE-2013-01858.8Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the au CVE-2013-01866.1Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspe CVE-2013-01876.5Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.CVE-2013-01895.0cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (res CVE-2013-01904.9The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local us