Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-49070

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 18.12.10
1 Metasploit module, 7 proofs of concept on GitHub, 1 Nuclei template

Summary

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.  Users are recommended to upgrade to version 18.12.10

Timeline

  1. CVE published
  2. Record last updated
  3. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Software Foundation Apache OFBiz

    fixed in 18.12.10

References 15

ofbiz.apache.org

issues.apache.org

lists.apache.org

packetstormsecurity.com

GitHub · rapid7/metasploit-framework

GitHub · projectdiscovery/nuclei-templates

GitHub · 0xrobiul/CVE-2023-49070

GitHub · BardLaudian/CVE-2023-49070

GitHub · D0g3-8Bit/OFBiz-Attack

GitHub · GraySignal/Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467

GitHub · UserConnecting/Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz

GitHub · abdoghazy2015/ofbiz-CVE-2023-49070-RCE-POC

GitHub · yukselberkay/CVE-2023-49070_CVE-2023-51467