Not rated
CVE-2021-30128 Apache OFBiz has unsafe deserialization prior to 17.12.07 version
Description
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OFBiz 17.12 | earliest → < 17.12.07 | 17.12.07 |
References
- lists.apache.org lists.apache.org
- [ofbiz-notifications] 20210427 [jira] [Updated] (OFBIZ-12221) Fixed ObjectInputStream denyList [CVE-2021-30128] lists.apache.org
- [ofbiz-notifications] 20210427 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128] lists.apache.org
- [oss-security] 20210427 [CVE-2021-30128] Unsafe deserialization in OFBiz www.openwall.com
- [ofbiz-user] 20210427 [CVE-2021-30128] Unsafe deserialization in OFBiz lists.apache.org
- [ofbiz-commits] 20210427 [ofbiz-site] branch master updated: Updates security page for CVE-2021-29200 and 30128 fixed in 17.12.07 lists.apache.org
- [announce] 20210427 [CVE-2021-30128] Unsafe deserialization in OFBiz lists.apache.org
- [ofbiz-notifications] 20210605 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128] lists.apache.org
- [ofbiz-notifications] 20210729 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128] lists.apache.org
- [ofbiz-commits] 20210811 [ofbiz-site] branch master updated: Updates security page for CVE-2021-37608 fixed in 17.12.08 lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache OFBiz
The 97 CVEs of Apache OFBiz →
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
Not rated
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA component
Not rated
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
Not rated
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Not rated