{"id":"CVE-2026-114229","kind":"vulnerability","aliases":["CVE-2026-114229"],"related":[],"title":"Apache OFBiz: crafted image URL runs script in back-office user's browser","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"The Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 does not neutralize input in the viewImage URL, so a crafted link can inject JavaScript. An unauthenticated attacker can make a logged-in back-office user run that script in their browser session if the user opens the link from within the application.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","package","self-hosted"],"not_affected_if":["version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version; affected versions are 24.09 before `24.09.08`.\n- Look for the Catalog image viewer (`viewImage` requests) in the application's web logs.","fix":"- Apache OFBiz: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:51+00:00","updated_at":"2026-11-05T14:40:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`.","reach":"internet","title":"Apache OFBiz: crafted image URL runs script in back-office user's browser","impact":"medium","summary":"The Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 does not neutralize input in the viewImage URL, so a crafted link can inject JavaScript. An unauthenticated attacker can make a logged-in back-office user run that script in their browser session if the user opens the link from within the application.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"script runs in a back-office user's logged-in session","analyst_note":"","how_to_check":"- Check the installed OFBiz version; affected versions are 24.09 before `24.09.08`.\n- Look for the Catalog image viewer (`viewImage` requests) in the application's web logs.","plain_action":"","needs_analyst":false,"not_affected_if":["version-24.09.08-or-later"],"who_is_affected":"Teams running Apache OFBiz 24.09 before 24.09.08 with the Catalog image viewer reachable from the back office. The exposure is through the browser of a logged-in back-office user who opens a crafted viewImage link, so teams on other OFBiz versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4281,"output_tokens":535,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114229':17A,20A '-2026':16A,19A '24.09':36B,104C '24.09.08':38B,106C,151C 'allow':110C 'apach':1A,22B,34B,102C 'apache-ofbiz':21B 'applic':83B,143C 'arbitrari':116C 'attack':56B,113C 'back':10A,64B,128C 'back-offic':9A,63B,127C 'browser':14A,72B,120C 'catalog':30B,98C 'craft':3A,49B,133C 'cross':93C 'cross-sit':92C 'cve':15A,18A 'execut':115C 'fix':153C 'generat':91C 'host':28B 'imag':4A,31B,99C 'improp':84C 'inject':52B 'input':42B,87C 'issu':155C 'java':24B 'javascript':53B,117C 'link':50B,79B 'log':61B,125C 'logged-in':60B,124C 'make':58B 'neutral':41B,85C 'ofbiz':2A,23B,35B,103C 'offic':11A,65B,129C 'open':77B,139C 'packag':25B 'page':90C 'platform':109C 'recommend':146C 'run':6A,67B 'script':7A,69B,95C 'self':27B 'self-host':26B 'session':73B,121C 'site':94C 'unauthent':55B,112C 'upgrad':148C 'url':5A,46B,135C 'user':12A,66B,76B,130C,138C,144C 'version':150C 'via':131C 'viewer':32B,100C 'viewimag':45B,134C 'web':89C 'within':81B,141C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 before 24.09.08 with the Catalog image viewer reachable from the back office. The exposure is through the browser of a logged-in back-office user who opens a crafted viewImage link, so teams on other OFBiz versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","java","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114229","severity":null,"published_at":"2026-11-05T14:17:00+00:00","modified_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}