CVE-2021-39181

Katalog CVE

CVSS 8.8 · High EPSS 1,9%

Kerentanan XML Injection (aka Blind XPath Injection) pada frentix openolat. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Rincian

Terbit di NVD

1 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-91: XML Injection (aka Blind XPath Injection)

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenOLAT/OpenOLAT/commit/3f219ac457afde82e3be57bc614352ab92c05684 patch · advisory pihak ketiga
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-596v-3gwh-2m9w advisory pihak ketiga
• https://jira.openolat.org/browse/OO-5548 permissions required