PT-2023-7705 · Apache · Apache Ofbiz

Siebene · Published 2023-12-04 · Updated 2025-08-03 · CVE-2023-49070

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.10

Description The issue is related to a pre-authentication remote code execution vulnerability in Apache OFBiz due to the presence of unmaintained XML-RPC. This vulnerability allows an attacker to execute arbitrary code remotely. The estimated number of potentially affected devices worldwide is around 1,920, mainly distributed in the United States, China, and other countries. There have been reports of this issue being exploited in the wild, with attackers gaining full control over the server and potentially siphoning sensitive data.

Recommendations For Apache OFBiz versions prior to 18.12.10, users are recommended to upgrade to version 18.12.10 to resolve the issue. As a temporary workaround, consider disabling the XML-RPC functionality until a patch is available. Restrict access to the vulnerable webtools/control/xmlrpc endpoint to minimize the risk of exploitation. Avoid using the vulnerable XML-RPC functionality in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-08772

CVE-2023-49070

Affected Products

Apache Ofbiz

References · 77

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization.rb · Exploit
• 🔥 https://github.com/abdoghazy2015/ofbiz-CVE-2023-49070-RCE-POC · Exploit
• 🔥 https://github.com/D0g3-8Bit/OFBiz-Attack · Exploit
• 🔥 https://github.com/UserConnecting/Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz · Exploit
• https://ofbiz.apache.org/security.html · Vendor Advisory
• https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3 · Vendor Advisory
• https://issues.apache.org/jira/browse/OFBIZ-12812 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49070 · Security Note
• https://bdu.fstec.ru/vul/2023-08772 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49070 · Vendor Advisory
• https://twitter.com/cipherstorm/status/1747147817322479843 · Twitter Post
• https://t.me/true_secator/5288 · Telegram Post
• https://twitter.com/solminingpunk/status/1740442720991080597 · Twitter Post
• https://t.me/thebugbountyhunter/8207 · Telegram Post
• https://twitter.com/XynikIT/status/1740409281332064642 · Twitter Post