Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 95%
from disclosure to weapon9 days
Published on NVDDec 5
1st PoC+9d
metasploitJul 13
VulnCheck+24d
exploitation probability
95%top 1% of all CVEs
observed exploitation
yesVulnCheck
8 public exploit(s)
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10.
Users are recommended to upgrade to version 18.12.10
Affected products
Apache Software Foundation · Apache OFBizpublic PoCs found — 8
vulncheckvulncheck.com/xdb/6548bd971583unverifiedvulncheckvulncheck.com/xdb/344e23f32c76unverifiedvulncheckvulncheck.com/xdb/4dc3a3fdc858unverifiedvulncheckvulncheck.com/xdb/c4e194d7eb23unverifiedvulncheckvulncheck.com/xdb/574e73d29503unverifiedvulncheckvulncheck.com/xdb/2a467a44fcb2unverifiedvulncheckvulncheck.com/xdb/195744d33aabunverifiedvulncheckvulncheck.com/xdb/4383349bdc37unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.htmlhttps://issues.apache.org/jira/browse/OFBIZ-12812https://lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3https://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/release-notes-18.12.10.htmlhttps://ofbiz.apache.org/security.htmlhttps://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467