CVE-2021-30128

CRITICAL EXPLOITED NUCLEI

Apache OFBiz <17.12.07 - Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-30128 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including LioTree. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-30128, an Apache OFBiz deserialization vulnerability. The exploit generates a malicious payload using ysoserial, modifies it to bypass restrictions, and sends it via a SOAP request to achieve remote code execution.

Description

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

Exploits (1)

nomisec WORKING POC 21 stars
by LioTree · remote
https://github.com/LioTree/CVE-2021-30128-EXP

This repository contains a functional exploit for CVE-2021-30128, an Apache OFBiz deserialization vulnerability. The exploit generates a malicious payload using ysoserial, modifies it to bypass restrictions, and sends it via a SOAP request to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache OFBiz
No auth needed
Prerequisites: Access to the target's SOAP endpoint · Java runtime for payload generation
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Apache OFBiz <17.12.07 - Arbitrary Code Execution
CRITICALVERIFIEDby For3stCo1d
Shodan: http.html:"ofbiz" || ofbiz.visitor=
FOFA: app="Apache_OFBiz" || body="ofbiz" || app="apache_ofbiz"

References (10)

Core 10
Core References
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/04/27/5

Scores

CVSS v3 9.8
EPSS 0.8108
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2026-06-22
CWE
CWE-502
Status published
Products (1)
apache/ofbiz < 17.12.07
Published Apr 27, 2021
Tracked Since Feb 18, 2026