Lucene search

Jacques Leroux1337DAY-ID-39211

HistoryDec 29, 2023 - 12:00 a.m.

Apache OFBiz 18.12.09 Remote Code Execution Exploit

2023-12-2900:00:00

Jacques Leroux

0day.today

172

apache ofbiz

remote code execution

xml-rpc

security vulnerability

update

cve-2023-49070

10 High

AI Score

Confidence

High

0.794 High

EPSS

Percentile

98.3%

JSON

Apache OFBiz version 18.12.09 suffers from a pre-authentication remote code execution vulnerability.

From: Jacques Le Roux <jleroux () apache org>
Date: Mon, 04 Dec 2023 21:04:50 +0000

Severity: moderate

Affected versions:

- Apache OFBiz before 18.12.10

Description:

Pre-auth RCE in Apache Ofbiz 18.12.09.

It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10. 
Users are recommended to upgrade to version 18.12.10

This issue is being tracked as OFBIZ-12812 

Credit:

Siebene@ (finder)

References:

https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://ofbiz.apache.org/release-notes-18.12.10.html
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-49070
https://issues.apache.org/jira/browse/OFBIZ-12812


-----
Packet Storm Note
Below is the proof of concept circulating on twitter:

#POC: 
/webtools/control/xmlrpc;/?USERNAME=&PASSWORD=s&requirePasswordChange=Y