CVE-2021-39181 - CVE House
Back to Database
Status published High CVE-2021-39181

Unsafe Deserialization of User Data Using XStream

Vulnerability Description

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39181

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenOLAT

View All →
CVE-2024-28198
XML external entity (XXE) injection in OpenOLAT
Medium 4.6
CVE-2021-41242
Path Traversal in some REST methods leading to file upload to arbitrary places
High 8.1
CVE-2021-41152
Path Traversal in Folder Component Leading to Local File Inclusion
High 7.7
CVE-2021-39180
Path Traversal in Archive Handling Leading to Code Execution
High 8.1

Affected Vendor

Affected Software

OpenOLAT
Vulnerable Versions:
< 15.3.18, >= 15.4.0, < 15.5.3

Timeline

Official Publish: September 1st, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-91

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.