CVE-2023-51467
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
CRITICAL 9.8EPSS 96.0%
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
- Affected
- Apache Software Foundation · Apache OFBiz
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 96.00% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- critical · CWE-918
- Published
- 2023-12-26
- Updated
- 2024-08-19
Proof-of-concept exploits (16)
- 2ptr/BadBizness-CVE-2023-514670★ · 2024-01-13
- Chocapikk/CVE-2023-5146712★ · 2023-12-31
- ImuSpirit/CVE-2023-514674★ · 2024-01-02
- Jake123otte1/BadBizness-CVE-2023-514670★ · 2024-01-13
- JaneMandy/CVE-2023-514674★ · 2024-01-02
- Praison001/Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-514671★ · 2024-01-25
- Subha-BOO7/Exploit_CVE-2023-514670★ · 2024-01-04
- UserConnecting/Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz5★ · 2025-02-05
- basicinfosecurity/exploits0★ · 2024-03-09
- bruce120/Apache-OFBiz-Authentication-Bypass0★ · 2024-03-14
- jakabakos/Apache-OFBiz-Authentication-Bypass73★ · 2024-03-24
- jakeotte/BadBizness-CVE-2023-514670★ · 2024-01-13
- tw0point/BadBizness-CVE-2023-514670★ · 2024-01-13
- vulncheck-oss/cve-2023-514676★ · 2025-02-14
- yukselberkay/CVE-2023-49070_CVE-2023-514671★ · 2024-01-12
- GraySignal/Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-514671★ · 2024-01-25
Nuclei templates (1)
Metasploit modules (1)
Vulhub environments (1)
Security advisories
- https://issues.apache.org/jira/browse/OFBIZ-12873
- https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
- https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o
- https://ofbiz.apache.org/release-notes-18.12.11.html
- https://ofbiz.apache.org/download.html