Vulnerability identifier: #VU51585

Vulnerability risk: High

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2021-26295

CWE-ID: CWE-502

Exploitation vector: Network

Exploits in database: 8

• September 25, 2022
  • CVE-2021-26295 (CVE-2021-26295 EXP 可成功反弹Shell) [Github]
• January 13, 2022
  • CVE-2021-26295-Apache-OFBiz (CVE-2021-26295 Apache OFBiz rmi反序列化POC) [Github]
• September 29, 2021
  • exp_hub (漏洞复现与poc收集，CVE-2021-21975，cve-2021-22005，CVE-2021-26295，VMware vCenter任意文件读取) [Github]
• June 30, 2021
  • CVE-2021-26295 () [Github]
• June 15, 2021
  • CVE-2021-26295-Apache-OFBiz-EXP (Apache OFBiz rmi反序列化EXP(CVE-2021-26295)) [Github]
• May 24, 2021
  • CVE-2021-26295 (CVE-2021-26295 EXP 可成功反弹Shell) [Github]
• May 13, 2021
  • ofbiz-poc (CVE-2020-9496和CVE-2021-26295利用dnslog批量验证漏洞poc及exp) [Github]
• May 9, 2021
  • Apache OFBiz SOAP Java Deserialization [Metasploit]

Impact: Code execution

Vulnerable software:
OFBiz
Other software / Other software solutions

Vendor: Apache Foundation