CVE-2021-29200

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

Affected

Apache Software Foundation · Apache OFBiz

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

55.37% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-502

Published

2021-04-27

Updated

2024-08-03

Proof-of-concept exploits (1)

• freeide/CVE-2021-292000★ · 2021-05-11

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29200.yaml

Exploit collections (2)

• Apache OFBiz RMI Bypass RCE（CVE-2021-29200）.mdtzwlhack/Vulnerability
• CVE-2021-29200.yamlzan8in/afrog

Security advisories

• https://lists.apache.org/thread.html/re21d25d9fb89e36cea910633779c23f144b9b60596b113b7bf1…
• http://www.openwall.com/lists/oss-security/2021/04/27/4

References

• CVE Record
• NVD entry

Related

• CVE-2019-0708
• CVE-2019-2890
• CVE-2021-2394
• CVE-2021-31955