Skip to main content

Ofbiz CVE-2023-46819

MEDIUM
Missing Authentication for Critical Function (CWE-306)
2023-11-07 security@apache.org
Apache Authentication Bypass Ofbiz
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 07, 2023 - 11:15 nvd
MEDIUM 5.3

DescriptionNVD

Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09.

Users are recommended to upgrade to version 18.12.09

AnalysisAI

Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin.12.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

Technical ContextAI

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin.12.09. Users are recommended to upgrade to version 18.12.09 Affected products include: Apache Ofbiz. Version information: before 18.12.09..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Require authentication for all sensitive operations, implement defense in depth.

More in Ofbiz

View all
CVE-2024-38856 CRITICAL POC
9.8 Aug 05

Incorrect Authorization vulnerability in Apache OFBiz.12.14. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2024-32113 CRITICAL POC
9.8 May 08

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.13. Rate
CVE-2023-51467 CRITICAL POC
9.8 Dec 26

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary

CVE-2023-49070 CRITICAL POC
9.8 Dec 05

Pre-auth RCE in Apache Ofbiz 18.12.09. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, n
CVE-2021-26295 CRITICAL POC
9.8 Mar 22

Apache OFBiz has unsafe deserialization prior to 17.12.06. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2024-45507 CRITICAL POC
9.8 Sep 04

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OF
CVE-2021-30128 CRITICAL POC
9.8 Apr 27

Apache OFBiz has unsafe deserialization prior to 17.12.07 version. Rated critical severity (CVSS 9.8), this vulnerabilit
CVE-2021-29200 CRITICAL POC
9.8 Apr 27

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack. Rat
CVE-2024-36104 CRITICAL POC
9.1 Jun 04

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.14. Rate
CVE-2020-9496 MEDIUM POC
6.1 Jul 15

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03. Rated
CVE-2016-2170 CRITICAL
9.8 Apr 12

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands vi
CVE-2024-45195 HIGH POC
7.5 Sep 04

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerabili

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8
CVE-2024-46506 CRITICAL POC
10.0
CVE-2025-8943 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-46819 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy