Exploit for #VU51585 Deserialization of Untrusted Data in OFBiz

Vulnerability identifier: #VU51585

Vulnerability risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2021-26295

CWE-ID: CWE-502

Exploitation vector: Network

Exploits in database: 8

• September 25, 2022
  • CVE-2021-26295 (CVE-2021-26295 EXP 可成功反弹Shell) [Github]
• January 13, 2022
  • CVE-2021-26295-Apache-OFBiz (CVE-2021-26295 Apache OFBiz rmi反序列化POC) [Github]
• September 29, 2021
  • exp_hub (漏洞复现与poc收集，CVE-2021-21975，cve-2021-22005，CVE-2021-26295，VMware vCenter任意文件读取) [Github]
• June 30, 2021
  • CVE-2021-26295 () [Github]
• June 15, 2021
  • CVE-2021-26295-Apache-OFBiz-EXP (Apache OFBiz rmi反序列化EXP(CVE-2021-26295)) [Github]
• May 24, 2021
  • CVE-2021-26295 (CVE-2021-26295 EXP 可成功反弹Shell) [Github]
• May 13, 2021
  • ofbiz-poc (CVE-2020-9496和CVE-2021-26295利用dnslog批量验证漏洞poc及exp) [Github]
• May 9, 2021
  • Apache OFBiz SOAP Java Deserialization [Metasploit]

Vulnerable software:
OFBiz
Other software / Other software solutions

Vendor: Apache Foundation