Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.91
EPSS Ranking 99.6%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
Products affected by CVE-2018-8033
  • Apache » Ofbiz » Version: 16.11.01
    cpe:2.3:a:apache:ofbiz:16.11.01
  • Apache » Ofbiz » Version: 16.11.02
    cpe:2.3:a:apache:ofbiz:16.11.02
  • Apache » Ofbiz » Version: 16.11.03
    cpe:2.3:a:apache:ofbiz:16.11.03
  • Apache » Ofbiz » Version: 16.11.04
    cpe:2.3:a:apache:ofbiz:16.11.04


Products
Pricing
Contact Us

Shodan ® - All rights reserved