CVE-2023-49070

Description

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10

References

https://github.com/ismailmazumder/SL7CVELabsBuilder

https://github.com/securelayer7/SL7CVELabsBuilder

https://github.com/pulentoski/CVE-2023-51467-and-CVE-2023-49070

https://github.com/yukselberkay/CVE-2023-49070_CVE-2023-51467

https://github.com/D0g3-8Bit/OFBiz-Attack

https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass

https://github.com/Chocapikk/CVE-2023-51467

https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467

https://ofbiz.apache.org/security.html

https://ofbiz.apache.org/release-notes-18.12.10.html

https://ofbiz.apache.org/download.html

https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3

https://issues.apache.org/jira/browse/OFBIZ-12812

http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest