Date: Thu, 6 Feb 2020 15:25:27 +0100 From: Jacopo Cappellato <jacopoc@...che.org> To: oss-security@...ts.openwall.com Subject: [SECURITY] CVE-2019-12426 information disclosure vulnerability in Apache OFBiz Severity: Minor Vendor: The Apache Software Foundation Versions Affected: Apache OFBiz 16.11.01 to 16.11.06 Description: an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale. Mitigation: Upgrade to 16.11.07 Credit: This issue was discovered by Dennis Balkir <dennis.balkir@...mify.de>. References: http://ofbiz.apache.org/security.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.