CVE-2023-49070
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
- Record
CVE-2023-49070- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
- Record
CVE-2023-49070- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2023-53092 No score
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
- Record
EUVD-2023-53092- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9rm6-p86c-42xm
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present....
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
- Record
GHSA-9rm6-p86c-42xm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Apache OFBiz XML-RPC Java Deserialization | 2020-07-13 |
| Nuclei | Apache OFBiz < 18.12.10 - Arbitrary Code Execution | |
| PoC in GitHub | 0xrobiul/CVE-2023-49070 | 2023-12-17 |
| PoC in GitHub | BardLaudian/CVE-2023-49070 | 2026-09-24 |
| PoC in GitHub | D0g3-8Bit/OFBiz-Attack | 2024-01-04 |
| PoC in GitHub | GraySignal/Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467 | 2024-01-17 |
| PoC in GitHub | UserConnecting/Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz | 2024-01-08 |
| PoC in GitHub | abdoghazy2015/ofbiz-CVE-2023-49070-RCE-POC | 2023-12-14 |
| PoC in GitHub | yukselberkay/CVE-2023-49070_CVE-2023-51467 | 2024-01-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49070 is a critical vulnerability (CVSS 9.8) in Apache Ofbiz, published December 5, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.4%, the 99th percentile. No source names a fixed version.
References
ofbiz.apache.org/download.html
issues.apache.org/jira/browse/OFBIZ-12812
lists.apache.org/thread/jmbqk2lp4t4483whzndp5xqlq4f3otg3
packetstormsecurity.com/files/176323/Apache-OFBiz-18.12.09-Remote-Code-Execution.html
vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467
nvd.nist.gov/vuln/detail/CVE-2023-49070
github.com/advisories/GHSA-9rm6-p86c-42xm