Loading CVE intelligence

CVE-2023-49070

CriticalPublished

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

Published: Dec 5, 2023
Updated: Feb 13, 2025
Assigning CNA: apache
Evidence observed: Aug 7, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

95.4%

High · next 30 days

Percentile: 99.9%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10

Sources

7

CVE-2023-49070Exploit
Exploit Of Pre-auth RCE in Apache Ofbiz!!
Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467Exploit
This exploit scans whether the provided target is vulnerable to CVE-2023-49070/CVE-2023-51467 and also exploits it depending on the choice of the user.
CVE-2023-49070_CVE-2023-51467Exploit
Exploit and vulnerability scanner for CVE-2023-49070 and CVE-2023-51467, enabling automated detection and exploitation of Apache OFBiz vulnerabilities.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

ofbiz-CVE-2023-49070-RCE-POCPoC

Pre-auth RCE proof-of-concept for Apache OFBiz CVE-2023-49070, exploiting XML-RPC Java deserialization to achieve remote code execution on vulnerable versions.

OFBiz-AttackExploit

A Tool For CVE-2023-49070/CVE-2023-51467 Attack

Apache-OFBiz-Authentication-BypassExploit

This repo is a PoC with to exploit CVE-2023-51467 and CVE-2023-49070 preauth RCE vulnerabilities found in Apache OFBiz.

Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBizExploit

Authentication Bypass Vulnerability Apache OFBiz < 18.12.10.