CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

98.93% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium · CWE-502

Published

2020-07-15

Updated

2024-08-04

Proof-of-concept exploits (12)

• http://packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.html
• http://packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.html
• http://packetstormsecurity.com/files/163730/Apache-OfBiz-17.12.01-Remote-Command-Executio…
• JulianWu520/DriedMango8★ · 2021-07-12
• Ly0nt4r/CVE-2020-94962★ · 2023-04-23
• MrMeizhi/DriedMango8★ · 2021-07-12
• Vulnmachines/apache-ofbiz-CVE-2020-94961★ · 2021-06-10
• ambalabanov/CVE-2020-94960★ · 2021-06-06
• cyber-niz/CVE-2020-94960★ · 2021-05-07
• dwisiswant0/CVE-2020-94963★ · 2020-08-16
• g33xter/CVE-2020-94967★ · 2021-04-30
• s4dbrd/CVE-2020-94964★ · 2021-08-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9496.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserial…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50178

Vulhub environments (1)

• vulhub/vulhub/tree/master/ofbiz/CVE-2020-9496

Exploit collections (2)

• chaitin/xray/blob/master/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml
• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-9496.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-26295
• CVE-2026-43284
• CVE-2026-43500
• CVE-2018-7600
• CVE-2020-24148
• CVE-2020-5902