{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-03T04:07:35.223","vulnerabilities":[{"cve":{"id":"CVE-2017-15714","sourceIdentifier":"security@apache.org","published":"2018-01-04T15:29:00.210","lastModified":"2024-11-21T03:15:04.200","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code \"__format=%27;alert(%27xss%27)\" to the URL an alert window would execute."},{"lang":"es","value":"El plugin BIRT en Apache OFBiz de la versión 16.11.01 a la 16.11.03 no escapa la propiedad de la entrada de usuario pasada. Esto permite que se inyecte código pasando ese código a través de una URL. Por ejemplo, adjuntando este código \"__format=%27;alert(%27xss%27)\" a la URL se ejecuta una ventana de alerta."}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:16.11.01:*:*:*:*:*:*:*","matchCriteriaId":"21851FFA-CEEF-48E4-8DF6-75A28009A481"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:16.11.02:*:*:*:*:*:*:*","matchCriteriaId":"3B4C50A5-8B45-4627-8D41-74E181A54B33"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:16.11.03:*:*:*:*:*:*:*","matchCriteriaId":"7BCB8B08-4BC5-487C-A706-A722BB5B430C"}]}]}],"references":[{"url":"https://s.apache.org/UO3W","source":"security@apache.org","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://s.apache.org/UO3W","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"]}]}}]}