CVE-2020-9496: Apache OFBiz XML-RPC unsafe deserialization and XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe deserialization flaw can lead to remote code execution, public exploit references exist, and EPSS is near the top of the distribution, even though the CVSS base score is only 6.1 and the CVE is not in KEV.

What it is

Apache OFBiz 17.12.03 exposes XML-RPC endpoints that perform unsafe deserialization of untrusted data and are also vulnerable to cross-site scripting. The deserialization flaw is the serious part: it allows crafted XML-RPC requests to reach Java object deserialization, which is a well-known path to remote code execution. The XSS issue is secondary and requires a victim to interact with a crafted request.

Impact

An attacker who can reach the XML-RPC endpoint can trigger deserialization of attacker-controlled data, potentially leading to remote command execution on the OFBiz server. The XSS component can execute script in a victim's browser session, but the deserialization path is the higher-impact outcome.

Attack surface

Reached over the network via XML-RPC requests to the OFBiz web application; the CVSS vector shows no privileges required (PR:N) but user interaction required (UI:R), which fits the XSS component more than the deserialization path. The deserialization issue itself is network-reachable and does not inherently require authentication based on the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.98926, 99.9th percentile) and multiple references are tagged Exploit, including Packet Storm entries for Java deserialization and remote command execution. Public exploit material exists, so exploitation should be treated as practical rather than theoretical.

What to do

• Upgrade Apache OFBiz to a fixed release; the record names 17.12.03 as vulnerable, so apply the vendor's patched version.
• If immediate upgrade is not possible, restrict network access to OFBiz XML-RPC endpoints to trusted hosts only.
• Disable or block XML-RPC functionality that is not required for business operations.
• Apply input validation and deserialization filtering on any remaining XML-RPC handlers, and review Java deserialization gadget exposure on the host.
• Monitor Apache OFBiz security mailing list and vendor advisories for the exact fixed version and any follow-up patches.

Detection

• Inspect web and application logs for XML-RPC POST requests to OFBiz endpoints, especially those with unusual or serialized Java payloads.
• Alert on outbound network connections or process creation from the OFBiz server that are not part of normal application behavior, which may indicate post-exploitation.
• Monitor for known Java deserialization gadget signatures in HTTP request bodies reaching OFBiz.
• Review OFBiz access logs for anomalous client IPs or request patterns targeting XML-RPC paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.