CVE-2021-29200: RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 17.12.07
Event History
Frequently Asked Questions
What is CVE-2021-29200?
CVE-2021-29200 is a vulnerability in Apache OFBiz that allows an unauthenticated user to perform a remote code execution (RCE) attack.
How severe is CVE-2021-29200?
CVE-2021-29200 has a severity rating of critical with a CVSS score of 9.8.
How does CVE-2021-29200 affect Apache OFBiz?
CVE-2021-29200 affects Apache OFBiz versions prior to 17.12.07 and can be exploited by an unauthenticated user.
How can an unauthenticated user exploit CVE-2021-29200?
An unauthenticated user can exploit CVE-2021-29200 by performing a remote code execution (RCE) attack.
Is there a fix available for CVE-2021-29200?
Yes, the fix for CVE-2021-29200 is to upgrade to Apache OFBiz version 17.12.07 or newer.