UpHeron
All vulnerabilities

Servers and applications

CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to…

Severity
High 7.5
Published
26 Nov 2019
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
16% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache OFBizServers and applications · cpe:a:apache:ofbiz
  • From 16.11.01 up to 16.11.04

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-3600
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-3600