CVE-2011-3600: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injectio...

Security readout for executives and security teams

Apache OFBiz versions 16.11.01 through 16.11.04 exposed the XML-RPC webtools endpoint to XML external entity processing. If reachable, an attacker could make the system reveal local file contents, infer whether files exist, and probe internal ports through error behavior. The provided sources do not include a CVSS score or evidence of active exploitation. Exposure is most likely where affected OFBiz webtools XML-RPC endpoints are reachable from untrusted networks. Internet-facing ERP, commerce, or back-office deployments should be prioritized. Environments without OFBiz, outside versions 16.11.01 to 16.11.04, or with the endpoint inaccessible have lower apparent exposure. Prioritize this if affected OFBiz webtools endpoints are externally reachable or handle sensitive operations. The risk is meaningful because file disclosure and internal probing can support broader compromise, but urgency should be calibrated against actual version and endpoint exposure. Mitigation focus: Inventory Apache OFBiz deployments and confirm exact versions.; Prioritize OFBiz 16.11.01 through 16.11.04 for remediation review.; Check Apache OFBiz vendor guidance for fixed versions or supported upgrade paths..

Prepared

Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.