Unsafe deserialization in Apache OFBiz
Apache Software Foundation · Apache OFBiz
Apache OFBiz contains an unsafe deserialization flaw in versions prior to 17.12.07, affecting the product's deserialization handling of untrusted data. The provided information does not specify the attack vector, required privileges, user interaction, or configuration conditions needed to exploit it, so an attacker's capabilities cannot be stated beyond the ability to abuse the unsafe deserialization.
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 5 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+2 days
- First seen exploitedVulnCheck KEV evidence+5 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.