Paper/Archive/CVE-2021-26295

CVE-2021-26295

Apache Software Foundation Apache OFBiz — RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 99.9.999 × 2020.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Affected

ProductAffectedFixed inSource

Apache OFBizApache OFBiz 17.12.01 to 17.12.05–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References