Vulnerability · Published Dec 5, 2023 · Assigned by apache
CVE-2023-49070Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
Critical 9.8
In plain English
A critical-severity code injection in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 95.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)95.4%top 0.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling3Metasploit, Nuclei, Public PoC
Official description
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 – before 18.12.10 |
Weakness: CWE-94
References
- https://ofbiz.apache.org/download.html mitigation
- https://ofbiz.apache.org/security.html related
- https://ofbiz.apache.org/release-notes-18.12.10.html release-notes
- https://issues.apache.org/jira/browse/OFBIZ-12812 issue-tracking
- https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3 vendor-advisory
- http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html
- https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467