CVE-2021-39181

HIGH
Published Sep 1, 20214y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Sep 1, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-91

Affected Products 2

VendorProductVersionRange
frentixopenolat* <15.3.18
frentixopenolat*≥15.5.0  –  <15.5.3

References 3

  • github.com https://github.com/OpenOLAT/OpenOLAT/commit/3f219ac457afde82e3be57bc614352ab92c05684
    PatchThird Party Advisory
  • github.com https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-596v-3gwh-2m9w
    Third Party Advisory
  • jira.openolat.org https://jira.openolat.org/browse/OO-5548
    Permissions Required

Remediation

  • github.com https://github.com/OpenOLAT/OpenOLAT/commit/3f219ac457afde82e3be57bc614352ab92c05684
    PatchThird Party Advisory