Authored by Jacques Leroux

Apache OFBiz version 18.12.09 suffers from a pre-authentication remote code execution vulnerability.

advisories | CVE-2023-49070

From: Jacques Le Roux <jleroux () apache org>
Date: Mon, 04 Dec 2023 21:04:50 +0000

Severity: moderate

Affected versions:

- Apache OFBiz before 18.12.10


Pre-auth RCE in Apache Ofbiz 18.12.09.

It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10.
Users are recommended to upgrade to version 18.12.10

This issue is being tracked as OFBIZ-12812


Siebene@ (finder)


Packet Storm Note
Below is the proof of concept circulating on twitter: