CVE-2021-29200

CRITICALNuclei

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-29200 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Apache OFBiz

Browse Apache Software Foundation / Apache OFBiz
CVE ListApache OFBiz to < 17.12.07affected

Nuclei templates

1
ProjectDiscoveryCRITICALApache OFBiz < 17.12.07 - Arbitrary Code ExecutionCVSS 9.8

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

Impact

Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code, leading to complete server compromise.

Remediation

Upgrade to Apache OFBiz version 17.12.07 or later.

WeaknessesCWE-502
Authorsyour3cho
Template tagscve2021cveapacheofbizdeserializationrcevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
Shodan: html:"OFBiz"
Shodan: http.html:"ofbiz"
Shodan: ofbiz.visitor=
FOFA: app="Apache_OFBiz"
FOFA: body="ofbiz"
FOFA: app="apache_ofbiz"
http://www.openwall.com/lists/oss-security/2021/04/27/4 https://nvd.nist.gov/vuln/detail/CVE-2021-29200 https://github.com/freeide/CVE-2021-29200 https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E https://lists.apache.org/thread.html/r708351f1a8af7adb887cc3d8a92bed8fcbff4a9e495e69a9ee546fda%40%3Cnotifications.ofbiz.apache.org%3E

Source: ProjectDiscovery

References

Showing 12 of 14