CVE-2023-49070

Vulnerability updated 7 days ago (2024-11-29T14:01:53.349Z)
Download STIX
Preview STIX
CVE-2023-49070 is a critical vulnerability discovered in Apache OFBiz, a widely used open-source enterprise resource planning system. The vulnerability is related to insecure deserialization within the XML-RPC interface of the software, which could potentially allow an attacker to execute arbitrary code remotely (RCE). This severe flaw, with a CVSS score of 9.8, was first reported on platforms like Indusface and Security Boulevard, highlighting its potential for significant impact. The situation became more complex when another vulnerability, CVE-2023-51467, was identified. This flaw, also scoring a 9.8 on the CVSS scale, resides in the login functionality of Apache OFBiz and can be exploited to bypass authentication mechanisms. Interestingly, this issue arose as a result of an incomplete patch for the original CVE-2023-49070 vulnerability, demonstrating how one problem can lead to another if not thoroughly addressed. These two vulnerabilities together pose a significant threat, as they enable an untrusted attacker to bypass authentication and gain access to the XML-RPC interface, where they can then exploit the RCE flaw. The discovery of these vulnerabilities underscores the importance of comprehensive security practices in software development and the need for thorough vulnerability management to prevent such high-risk situations from arising.
Description last updated: 2024-05-04T20:34:57.021Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Apache
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.