Vulnerabilities > CVE-2021-26295 - Deserialization of Untrusted Data vulnerability in Apache Ofbiz

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

apache

CWE-502

critical

NVD

Published: 2021-03-22

Updated: 2023-11-07

Summary

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Ofbiz - Apache Ofbiz 09.04 Apache Ofbiz 9.04 Apache Ofbiz 09.04.01 Apache Ofbiz 9.04.01 Apache Ofbiz 9.04.02 Apache Ofbiz 10.04 Apache Ofbiz 10.04.01 Apache Ofbiz 10.04.02 Apache Ofbiz 10.04.03 Apache Ofbiz 10.04.04 Apache Ofbiz 10.04.05 Apache Ofbiz 10.04.06 Apache Ofbiz 11.04 Apache Ofbiz 11.04.01 Apache Ofbiz 11.04.02 Apache Ofbiz 11.04.03 Apache Ofbiz 11.04.04 Apache Ofbiz 11.04.05 Apache Ofbiz 11.04.06 Apache Ofbiz 12.04 Apache Ofbiz 12.04.01 Apache Ofbiz 12.04.02 Apache Ofbiz 12.04.03 Apache Ofbiz 12.04.04 Apache Ofbiz 12.04.05 Apache Ofbiz 12.04.06 Apache Ofbiz 13.07 Apache Ofbiz 13.07.01 Apache Ofbiz 13.07.02 Apache Ofbiz 13.07.03 Apache Ofbiz 16.11.01 Apache Ofbiz 16.11.02 Apache Ofbiz 16.11.03 Apache Ofbiz 16.11.04 Apache Ofbiz 16.11.05 Apache Ofbiz 16.11.06 Apache Ofbiz 16.11.07 Apache Ofbiz 17.12.01 Apache Ofbiz 17.12.03 Apache Ofbiz 17.12.04 Apache Ofbiz 17.12.05	42

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Vulnerabilities > CVE-2021-26295 - Deserialization of Untrusted Data vulnerability in Apache Ofbiz

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Related news

References