CVE-2021-39181

Summary

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Affected Software

VendorProductVersion RangeStatus
OpenOLATOpenOLAT< 15.3.18affected
OpenOLATOpenOLAT>= 15.4.0, < 15.5.3affected

Weaknesses

  • CWE-91: CWE-91: XML Injection (aka Blind XPath Injection)

ADP Enrichment

CVE Program Container

Additional References

References