Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2021-26295

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Published
Last modified
published
Not listed in CISA KEV
1 Metasploit module, 5 proofs of concept on GitHub, 1 Nuclei template

Summary

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Timeline

  1. CVE published
  2. Record last updated
  3. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Software Foundation Apache OFBiz

    Apache OFBiz 17.12.01 to 17.12.05

References 20

lists.apache.org

packetstormsecurity.com

GitHub · rapid7/metasploit-framework

GitHub · projectdiscovery/nuclei-templates

GitHub · coolyin001/CVE-2021-26295--

GitHub · dskho/CVE-2021-26295

GitHub · rakjong/CVE-2021-26295-Apache-OFBiz

GitHub · yuaneuro/ofbiz-poc

GitHub · yumusb/CVE-2021-26295