Vulnerability identifier: #VU34153

Vulnerability risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C]

CVE-ID: CVE-2020-9496

CWE-ID: CWE-79

Exploitation vector: Network

Exploits in database: 10

• June 27, 2023
  • CVE-2020-9496 (ApacheOfBiz 17.12.01 Remote Code Execution) [Github]
• August 16, 2022
  • CVE-2020-9496 (ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión ) [Github]
• November 25, 2021
  • ApacheOfBiz 17.12.01 - Remote Command Execution (RCE) via Unsafe Deserialization of XMLRPC arguments [Exploit-DB]
• August 5, 2021
  • CVE-2020-9496 () [Github]
• June 6, 2021
  • CVE-2020-9496 (XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03) [Github]
• May 13, 2021
  • ofbiz-poc (CVE-2020-9496和CVE-2021-26295利用dnslog批量验证漏洞poc及exp) [Github]
• May 9, 2021
  • Apache OFBiz XML-RPC Java Deserialization [Metasploit]
  • CVE-2020-9496 (CVE-2020-9496 manual exploit) [Github]
• May 3, 2021
  • CVE-2020-9496 (Apache OFBiz unsafe deserialization of XMLRPC arguments) [Github]
• August 17, 2020
  • Apache OFBiz XML-RPC Java Deserialization [Metasploit]

Impact: Information disclosure and data manipulation

Vulnerable software:
OFBiz
Other software / Other software solutions

Vendor: Apache Foundation