Security News > 2021 > March > Remote Code Execution Vulnerability Patched in Apache OFBiz

Remote Code Execution Vulnerability Patched in Apache OFBiz
2021-03-23 04:52

One of the vulnerabilities addressed by the latest update for Apache OFBiz is an unsafe Java deserialization issue that could be exploited to execute code remotely, without authentication.

A Java-based web framework, Apache OFBiz is an open source enterprise resource planning system that includes a suite of applications to automate business processes within enterprise environments, and which can be used across any industry.

OFBiz is one of the platforms that was affected by a Java serialization vulnerability identified and reported in 2015, and which impacted the Apache Commons Collections and Apache Groovy libraries that OFBiz relies on.

Following the addressing of an issue with ObjectInputStream class, where users needed to add their own objects/classes to the list of objects used by OFBiz OOTB, Apache also implemented the option to deny objects.

Apache OFBiz 17.12.06, the sixth and final release of the 17.12 series, includes a patch for CVE-2021-26295, adding a "Blacklist in Java serialization."

The unsafe deserialization, he explains, could be exploited to execute code remotely, essentially allowing an unauthenticated attacker to successfully take over Apache OFBiz.


News URL

http://feedproxy.google.com/~r/Securityweek/~3/tANS6EYYLzE/remote-code-execution-vulnerability-patched-apache-ofbiz

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2021-03-22 CVE-2021-26295 Deserialization of Untrusted Data vulnerability in Apache Ofbiz
Apache OFBiz has unsafe deserialization prior to 17.12.06.
network
low complexity
apache CWE-502
critical
9.8

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Apache 281 13 549 713 367 1642