CVE-2023-51467: Apache OFBiz authentication bypass leading to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score and near-maximum EPSS probability makes this an urgent patch-first issue.

What it is

Apache OFBiz contains an authentication bypass that lets an unauthenticated attacker reach functionality normally requiring login, and the record states this enables remote arbitrary code execution. The flaw is tracked as CWE-918 (SSRF), which is a mismatch with the described authentication bypass and RCE, so the exact root cause is not fully clear from the record. With a CVSS 3.1 score of 9.8 and an EPSS 30-day probability near 0.96, this is a high-urgency issue for any internet-facing OFBiz deployment.

Impact

An attacker gains unauthenticated remote code execution, meaning full control over the application process and its data. Given the CVSS vector (C:H/I:H/A:H), confidentiality, integrity and availability are all fully compromised.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The record does not specify which endpoint or component is involved, so the exact entry point cannot be confirmed from the supplied facts.

Exploitation

Not listed in CISA KEV, but EPSS is 0.96001 (99.873rd percentile), indicating very high predicted exploitation activity. References include vendor advisories, patch and release notes, but no public exploit tag is present in the record.

What to do

• Apply the Apache OFBiz fix referenced in the vendor advisory and issue tracker (OFBIZ-12873) and upgrade to the patched release noted in the 18.12.11 release notes.
• If patching cannot be done immediately, remove OFBiz from direct internet exposure and place it behind authentication or a restricting reverse proxy.
• Restrict outbound network access from OFBiz hosts to limit SSRF-style abuse and post-exploitation callbacks.
• Review OFBiz accounts, configuration and deployed code for unauthorized changes, and rotate credentials and secrets that the service could reach.
• Monitor vendor mailing lists and the OFBiz security page for follow-up advisories, since the record's CWE and description do not fully align.

Detection

• Hunt web logs for requests to OFBiz endpoints that succeed without a prior authenticated session, especially unusual or malformed parameters.
• Alert on outbound connections from OFBiz hosts to unexpected internal or external destinations, consistent with SSRF behavior.
• Monitor for unexpected child processes, shell execution or file writes spawned by the OFBiz Java process.
• Baseline and alert on changes to OFBiz configuration files, deployed components and scheduled jobs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.