« Volver al listado

CVE-2023-51467

Estado: ModificadaCrítica (9.8)—💥 Exploit

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

Tecnologías afectadas (1)

Apache — Ofbiz

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-51467",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache OFBiz",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "18.12.11",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-26T15:15:08.853",
  "references": [
    {
      "url": "https://issues.apache.org/jira/browse/OFBIZ-12873",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://ofbiz.apache.org/download.html",
      "tags": [
        "Product"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://ofbiz.apache.org/release-notes-18.12.11.html",
      "tags": [
        "Release Notes"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://ofbiz.apache.org/security.html",
      "tags": [
        "Not Applicable"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2023/12/26/3",
      "source": "security@apache.org"
    },
    {
      "url": "https://issues.apache.org/jira/browse/OFBIZ-12873",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48o",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ofbiz.apache.org/download.html",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ofbiz.apache.org/release-notes-18.12.11.html",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ofbiz.apache.org/security.html",
      "tags": [
        "Not Applicable"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2023/12/26/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code\n\n"
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad permite a los atacantes omitir la autenticación para lograr Server-Side Request Forgery (SSRF) simple."
    }
  ],
  "lastModified": "2026-06-17T06:41:00.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6050132-AADE-4AC9-9C96-C8333441D0EB",
              "versionEndExcluding": "18.12.11"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}