CVE-2023-49070

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Pre-auth RCE in Apache Ofbiz 18.12.09.

It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	< 18.12.10

References

http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html
https://issues.apache.org/jira/browse/OFBIZ-12812Issue Tracking, Patch
https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3Mailing List
https://ofbiz.apache.org/download.htmlProduct
https://ofbiz.apache.org/release-notes-18.12.10.htmlRelease Notes
https://ofbiz.apache.org/security.htmlVendor Advisory
http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html
https://issues.apache.org/jira/browse/OFBIZ-12812Issue Tracking, Patch
https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3Mailing List
https://ofbiz.apache.org/download.htmlProduct
https://ofbiz.apache.org/release-notes-18.12.10.htmlRelease Notes
https://ofbiz.apache.org/security.htmlVendor Advisory
https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467

Timeline

Published: Dec 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490737.2A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially cr CVE-2023-490747.5A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.CVE-2023-490757.2The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable t CVE-2023-490766.5Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occur CVE-2023-490776.1Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified CVE-2023-490786.1raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-w CVE-2023-490797.5Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate CVE-2023-49084.3Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI vi CVE-2023-490804.3The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter noteboo CVE-2023-490815.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modi CVE-2023-490825.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to mod CVE-2023-490837.5cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates