CVE-2021-26295
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
CRITICAL 9.8EPSS 97.8%
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
- Affected
- Apache Software Foundation · Apache OFBiz
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 97.82% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- critical · CWE-502
- Published
- 2021-03-22
- Updated
- 2025-02-13
Proof-of-concept exploits (8)
- http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html
- JulianWu520/DriedMango8★ · 2021-07-12
- Li468446/Apache_poc0★ · 2023-07-23
- MrMeizhi/DriedMango8★ · 2021-07-12
- coolyin001/CVE-2021-26295--0★ · 2021-04-09
- dskho/CVE-2021-262950★ · 2021-03-25
- rakjong/CVE-2021-26295-Apache-OFBiz4★ · 2021-03-24
- yumusb/CVE-2021-2629523★ · 2021-04-01
Nuclei templates (1)
Metasploit modules (1)
Exploit collections (1)
- Apache OFBiz RMI反序列化任意代码执行（CVE-2021-26295）.mdtzwlhack/Vulnerability