In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2018-12-13T14:00:00

Updated: 2024-08-05T06:46:11.540Z

Reserved: 2018-03-09T00:00:00

Link: CVE-2018-8033

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-12-13T14:29:00.387

Modified: 2024-11-21T04:13:08.430

Link: CVE-2018-8033

cve-icon Redhat

No data.