CVE-2021-39181
Assigner: GitHub_M
Published: 2021-09-01T19:45:11
State: PUBLISHED
affected: product: OpenOLAT
vendor: OpenOLAT
versions: status: affected
version: < 15.3.18
status: affected
version: >= 15.4.0, < 15.5.3
descriptions: value: OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-91
description: CWE-91: XML Injection (aka Blind XPath Injection)
type: CWE
source: advisory: GHSA-596v-3gwh-2m9w
discovery: UNKNOWN
title: Unsafe Deserialization of User Data Using XStream