CVE-2023-49070
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
- State
- Published
- Severity
- Not scored
- Published
- Dec 5, 2023
- Updated
- Feb 13, 2025
- Reserved
- Nov 21, 2023
Description
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
Scores
The record has no CVSS score.
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
Apache OFBizApache Software Foundation |
|
References
- https://ofbiz.apache.org/download.htmlmitigation
- https://ofbiz.apache.org/security.htmlrelated
- https://ofbiz.apache.org/release-notes-18.12.10.htmlrelease-notes
- https://issues.apache.org/jira/browse/OFBIZ-12812issue-tracking
- https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3vendor-advisory
- http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html
- https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.