{"id":"CVE-2023-51467","aliases":["EUVD-2023-56180","GHSA-9699-fmx5-wvpf"],"status":"published","title":"Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability","description":"The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.96001,"percentile":0.99876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2023-12-26T14:46:59Z","modified":"2026-06-17T06:41:00Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/apache_ofbiz_deserialization","title":"Apache OFBiz XML-RPC Java Deserialization","type":"exploit","platform":"Linux,Unix","date":"2020-07-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/apache_ofbiz_deserialization"},{"source":"nuclei","id":"CVE-2023-51467","title":"Apache OFBiz \u003c 18.12.11 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51467.yaml"},{"source":"pocgithub","id":"AhmedMansour93/Event-ID-217-Rule-Name-SOC254-Apache-OFBiz-Auth-Bypass-and-Code-Injection-0Day-CVE-2023-51467-","title":"AhmedMansour93/Event-ID-217-Rule-Name-SOC254-Apache-OFBiz-Auth-Bypass-and-Code-Injection-0Day-CVE-2023-51467-","date":"2024-09-13","url":"https://github.com/AhmedMansour93/Event-ID-217-Rule-Name-SOC254-Apache-OFBiz-Auth-Bypass-and-Code-Injection-0Day-CVE-2023-51467-"},{"source":"pocgithub","id":"Chocapikk/CVE-2023-51467","title":"Chocapikk/CVE-2023-51467","date":"2023-12-29","url":"https://github.com/Chocapikk/CVE-2023-51467"},{"source":"pocgithub","id":"CyberCTF/vulhub-ofbiz-cve-2023-51467","title":"CyberCTF/vulhub-ofbiz-cve-2023-51467","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-ofbiz-cve-2023-51467"},{"source":"pocgithub","id":"ImuSpirit/CVE-2023-51467","title":"ImuSpirit/CVE-2023-51467","date":"2023-12-29","url":"https://github.com/ImuSpirit/CVE-2023-51467"},{"source":"pocgithub","id":"Subha-BOO7/Exploit_CVE-2023-51467","title":"Subha-BOO7/Exploit_CVE-2023-51467","date":"2024-01-04","url":"https://github.com/Subha-BOO7/Exploit_CVE-2023-51467"},{"source":"pocgithub","id":"jakabakos/Apache-OFBiz-Authentication-Bypass","title":"jakabakos/Apache-OFBiz-Authentication-Bypass","date":"2024-01-02","url":"https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass"},{"source":"pocgithub","id":"jakeotte/BadBizness-CVE-2023-51467","title":"jakeotte/BadBizness-CVE-2023-51467","date":"2024-01-13","url":"https://github.com/jakeotte/BadBizness-CVE-2023-51467"},{"source":"pocgithub","id":"vulncheck-oss/cve-2023-51467","title":"vulncheck-oss/cve-2023-51467","date":"2024-01-09","url":"https://github.com/vulncheck-oss/cve-2023-51467"}],"products":[{"vendor":"apache","product":"ofbiz"},{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://ofbiz.apache.org/download.html","tags":["mitigation","x_transferred","Product"]},{"url":"https://ofbiz.apache.org/security.html","tags":["related","x_transferred","Not Applicable"]},{"url":"https://ofbiz.apache.org/release-notes-18.12.11.html","tags":["release-notes","x_transferred","Release Notes"]},{"url":"https://issues.apache.org/jira/browse/OFBIZ-12873","tags":["issue-tracking","x_transferred","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/26/3","tags":["x_transferred"]},{"url":"https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51467"},{"url":"http://www.openwall.com/lists/oss-security/2023/12/26/3"},{"url":"https://github.com/advisories/GHSA-9699-fmx5-wvpf"}],"sources":{"cve":[{"id":"CVE-2023-51467","title":"Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability","description":"The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code\n\n","status":"published","published":"2023-12-26T14:46:59.8Z","modified":"2024-08-19T07:48:14.509Z","updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2023-56180","description":"The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code\n\n","status":"published","published":"2023-12-26T14:46:59Z","modified":"2024-08-19T07:48:14Z","updated_at":"2026-11-03T00:56:15.627163Z"}],"ghsa":[{"id":"GHSA-9699-fmx5-wvpf","title":"The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side...","description":"The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)\n","status":"published","published":"2023-12-26T15:30:20Z","modified":"2023-12-26T15:30:26Z","updated_at":"2026-11-02T14:55:16.928981Z"}],"nvd":[{"id":"CVE-2023-51467","description":"The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code\n\n","status":"published","published":"2023-12-26T15:15:08.853Z","modified":"2026-06-17T06:41:00.937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:08:57.117371Z"}]}}