Apache · Apache Ofbiz · CVE-2021-29200
Name of the Vulnerable Software and Affected Versions:
Apache OFBiz versions prior to 17.12.07
Description:
The issue is related to unsafe deserialization, allowing an attacker to execute arbitrary code by sending a specially crafted request. This can be exploited by an unauthenticated user to perform a remote code execution (RCE) attack.
Recommendations:
For versions prior to 17.12.07, update to version 17.12.07 or later to resolve the issue. As a temporary workaround, consider restricting access to the deserialization functionality until a patch is applied.