CVE-2021-39181
OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.91%
- CWE
- CWE-91
- Published
- 2021-09-01
- Last modified
- 2026-03-13
Affected products
- OpenOLAT OpenOLAT
- OpenOLAT OpenOLAT
Weakness type
Related vulnerabilities
- CVE-2023-46214 — Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
- CVE-2022-34253 — Adobe Commerce XML Injection Arbitrary code execution
- CVE-2021-36020 — Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution
- CVE-2021-36033 — Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution
- CVE-2021-36028 — Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution
- CVE-2020-8479 — ABB Central Licensing System - XML External Entity Injection
- CVE-2021-21025 — Magento Commerce XML Injection Could Lead To Arbitrary Code Execution
- CVE-2021-21019 — Magento Commerce XML Injection Could Lead To Remote Code Execution