What is CVE-2019-0235?

CVE-2019-0235 is a high-severity vulnerability in Apache Ofbiz, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2020-04-30.

How severe is CVE-2019-0235?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2019-0235 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Apache Ofbiz

CVE-2019-0235

Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2020-04-30 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.327 (98.3th percentile), scored 2026-10-22.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.327 · newest: 0.327 · change: 0.000

Affected products

Apache Ofbiz — versions 17.12.01
Apache Ofbiz — versions 17.12.01

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

References

s.apache.org/n4vnt (Mailing List, Vendor Advisory)
packetstormsecurity.com/files/157514/Apache-OFBiz-17.12.03-Cross-Site-Request-F… (Exploit, VDB Entry, Third Party Advisory)
lists.apache.org/thread.html/rbd572bb27991835a3455c1bf694e7140d79ab03cdb9e6e50f… (mailing-list)
lists.apache.org/thread.html/r392206f7cd131f0fc3f7c60a767ced93ced00411d55c1777c… (mailing-list)
lists.apache.org/thread.html/rfe36dc9135810954ef667d29129d02207fb999a286b60d33b… (mailing-list)
lists.apache.org/thread.html/r9eeb6c41d2c562b451f1e48ec56881f59107cc4dea7c883db… (mailing-list)
lists.apache.org/thread.html/rb53870d24088956a555683aa1aea7e532e3be65b863b9c75e… (mailing-list)
lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da… (mailing-list)
lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e46… (mailing-list)

Frequently asked questions

What is CVE-2019-0235?: CVE-2019-0235 is a high-severity vulnerability in Apache Ofbiz, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2020-04-30.
How severe is CVE-2019-0235?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2019-0235 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.