You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@ofbiz.apache.org by Jacopo Cappellato <ja...@apache.org> on 2020/02/06 14:25:16 UTC
[SECURITY] CVE-2019-12426 information disclosure vulnerability in
Apache OFBiz
Severity:
Minor
Vendor:
The Apache Software Foundation
Versions Affected:
Apache OFBiz 16.11.01 to 16.11.06
Description:
an unauthenticated user could get access to information of some backend
screens by invoking setSessionLocale.
Mitigation:
Upgrade to 16.11.07
Credit:
This issue was discovered by Dennis Balkir <de...@ecomify.de>.
References:
http://ofbiz.apache.org/security.html