CVE-2011-3600 is an External Entity Injection vulnerability affecting Apache OFBiz versions 16.11.01 to 16.11.04, specifically within the /webtools/control/xmlrpc endpoint. This high-severity vulnerability (CVSS 7.5) allows unauthenticated attackers to disclose file contents, probe network ports, and determine file existence through crafted DOCTYPE declarations. While there is no evidence of active exploitation or Metasploit modules, Nuclei templates exist for detection, and the vulnerability has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 16.11.01, <= 16.11.04CPE matchmatch criteria | cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Nov 26, 2019XML-RPC SAX parser information exposure
Feb 6, 2010