PT-2016-5045 · Apache · Apache Commons Collections+1

Jacques Le Roux · Published 2016-04-12 · Updated 2022-05-25 · CVE-2016-2170

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 12.04.x through 12.04.05 Apache OFBiz versions 13.07.x through 13.07.02

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Recommendations For Apache OFBiz versions 12.04.x through 12.04.05, update to version 12.04.06 or later. For Apache OFBiz versions 13.07.x through 13.07.02, update to version 13.07.03 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-2170

Affected Products

Apache Commons Collections

Apache Ofbiz

References · 20

• https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07 · Vendor Advisory
• https://issues.apache.org/jira/browse/OFBIZ-6726 · Vendor Advisory
• https://cwiki.apache.org/confluence/display/OFBIZ/The+infamous+Java+serialization+vulnerability · Vendor Advisory
• https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2170 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2170 · Vendor Advisory
• http://ofbiz.apache.org/download.html#vulnerabilities · Vendor Advisory
• https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244%40%3Cnotifications.ofbiz.apache.org%3E · Note
• https://t.me/cvenotify/15622 · Telegram Post
• https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735%40%3Cnotifications.ofbiz.apache.org%3E · Note
• https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a%40%3Cdev.ofbiz.apache.org%3E · Note
• http://securityfocus.com/archive/1/538034/100/0/threaded · Note
• https://t.me/cvenotify/12233 · Telegram Post
• https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6%40%3Cdev.ofbiz.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0%40%3Cdev.ofbiz.apache.org%3E · Note