Back to KEVs

CVE-2023-49070

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

Basic Information

CVE State
PUBLISHED
Reserved Date
November 21, 2023
Published Date
December 05, 2023
Last Updated
February 13, 2025
Vendor
Apache Software Foundation
Product
Apache OFBiz
Description
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.  Users are recommended to upgrade to version 18.12.10
Tags
metasploit_scanner apache nuclei_scanner

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Score
93.89% (Percentile: 99.86%) as of 2025-06-14

Exploit Status

Exploited in the Wild
Yes (2025-05-26 00:00:00 UTC) Source

References

https://ofbiz.apache.org/download.html https://ofbiz.apache.org/security.html https://ofbiz.apache.org/release-notes-18.12.10.html https://issues.apache.org/jira/browse/OFBIZ-12812 https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3 http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-05-27 12:00:21 UTC

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization.rb 2025-04-29 11:01:11 UTC
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49070.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

yukselberkay/CVE-2023-49070_CVE-2023-51467

Type: github • Created: 2024-01-11 22:35:57 UTC • Stars: 1

CVE-2023-49070 exploit and CVE-2023-49070 & CVE-2023-51467 vulnerability scanner

UserConnecting/Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz

Type: github • Created: 2024-01-08 03:13:43 UTC • Stars: 4

Authentication Bypass Vulnerability Apache OFBiz < 18.12.10.

0xrobiul/CVE-2023-49070

Type: github • Created: 2023-12-17 22:56:10 UTC • Stars: 1

Exploit Of Pre-auth RCE in Apache Ofbiz!!

abdoghazy2015/ofbiz-CVE-2023-49070-RCE-POC

Type: github • Created: 2023-12-14 09:32:41 UTC • Stars: 58

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Detected by Metasploit

  • Added to KEVIntel