{"id":"CVE-2023-51467","published":"2023-12-26T14:46:59Z","modified":"2024-08-19T07:48:14Z","title":"Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability","vendor":"Apache Software Foundation","product":"Apache OFBiz","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache OFBiz","versions":["< 18.12.11"]}],"description":{"text":"The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code\n\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a pre-authentication remote code execution vulnerability in Apache OFBiz, the Apache Software Foundation's open-source enterprise resource planning framework. An attacker can bypass the product's authentication processes and remotely execute arbitrary code, though the source record does not specify the network position, credentials, user interaction, or configuration required for exploitation.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:59Z"},"cvss":null,"epss":{"score":0.96001,"percentile":0.99876,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-02","exploitedFirstSeen":"2024-01-02","ransomware":false,"evidence":[{"url":"https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/","date":"2024-01-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-03&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-10&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-11&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-13&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-14&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-15&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-16&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-17&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-19&host_type=src&vulnerability=cve-2023-51467","date":"2024-01-19"}],"evidenceTotal":681,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://ofbiz.apache.org/download.html","tags":["mitigation"]},{"url":"https://ofbiz.apache.org/security.html","tags":["related"]},{"url":"https://ofbiz.apache.org/release-notes-18.12.11.html","tags":["release-notes"]},{"url":"https://issues.apache.org/jira/browse/OFBIZ-12873","tags":["issue-tracking"]},{"url":"https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o","tags":["vendor-advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/26/3","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-56180","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-56180","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":1,"earliest":"2023-12-29","earliestUrl":"https://github.com/ImuSpirit/CVE-2023-51467","repos":[{"name":"jakabakos/Apache-OFBiz-Authentication-Bypass","url":"https://github.com/jakabakos/Apache-OFBiz-Authentication-Bypass","stars":73,"created":"2024-01-02"},{"name":"Chocapikk/CVE-2023-51467","url":"https://github.com/Chocapikk/CVE-2023-51467","stars":12,"created":"2023-12-29"},{"name":"vulncheck-oss/cve-2023-51467","url":"https://github.com/vulncheck-oss/cve-2023-51467","stars":6,"created":"2024-01-09"},{"name":"ImuSpirit/CVE-2023-51467","url":"https://github.com/ImuSpirit/CVE-2023-51467","stars":4,"created":"2023-12-29"},{"name":"jakeotte/BadBizness-CVE-2023-51467","url":"https://github.com/jakeotte/BadBizness-CVE-2023-51467","stars":0,"created":"2024-01-13"}]},"metasploit":[{"name":"Apache OFBiz XML-RPC Java Deserialization","module":"exploit/linux/http/apache_ofbiz_deserialization","type":"exploit","disclosureDate":"2020-07-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization.rb"}],"nuclei":[{"id":"CVE-2023-51467","name":"Apache OFBiz < 18.12.11 - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-51467.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51467.yaml"}],"first":{"date":"2020-07-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-07-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-12-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization.rb","provenance":"source"},{"date":"2023-12-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-51467","provenance":"source"},{"date":"2024-01-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":60.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1034 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9988"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}