CVE-2020-1943: Apache OFBiz contentId parameter XSS in /control/stream

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable with no authentication and has a very high EPSS score, though it requires user interaction and is rated medium severity by CVSS.

What it is

Apache OFBiz 16.11.01 through 16.11.07 does not sanitize data sent via the contentId parameter to /control/stream, allowing reflected cross-site scripting. Because the endpoint is reachable over the network and the flaw affects the browser context of a victim, it can be used to run script in a logged-in user's session.

Impact

An attacker can execute arbitrary script in the victim's browser within the OFBiz origin, potentially stealing session cookies or performing actions as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted request to /control/stream with a malicious contentId value; no authentication is required (PR:N) but the victim must be induced to interact with the crafted link or page (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded in this data, but EPSS is very high (0.973, 99.9th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Upgrade Apache OFBiz to a release later than 16.11.07 that contains the fix referenced in the vendor advisory.
• If upgrade is not immediately possible, restrict network access to /control/stream and related OFBiz endpoints to trusted users or networks.
• Deploy a WAF or reverse-proxy rule that rejects or encodes suspicious contentId values containing script or HTML markup.
• Set session cookies with HttpOnly and SameSite attributes to reduce the impact of successful XSS.
• Review the vendor advisory at s.apache.org/pr5u8 for the official remediation guidance.

Detection

• Search web and proxy logs for requests to /control/stream with contentId values containing script tags, event handlers, or encoded HTML.
• Monitor for outbound or inline script execution anomalies tied to OFBiz responses, such as unexpected JavaScript in reflected content.
• Alert on repeated or automated requests to /control/stream from a single source, which may indicate scanning or exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.