{"cve":"CVE-2021-37578","nvd":{"published":"2021-07-29T07:15:06.693","modified":"2026-06-17T04:00:46.733","status":"Modified","description":"Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["http://www.openwall.com/lists/oss-security/2021/07/29/1","https://lists.apache.org/thread.html/r82047b3ba774cf870ea8e1e9ec51c6107f6cd056d4e36608148c6e71%40%3Cprivate.juddi.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/29/1","https://lists.apache.org/thread.html/r82047b3ba774cf870ea8e1e9ec51c6107f6cd056d4e36608148c6e71%40%3Cprivate.juddi.apache.org%3E"],"products":["apache:juddi"],"source":"nvd","synced_at":"2026-10-19T21:21:13.713336758+00:00"},"epss":{"cve":"CVE-2021-37578","score":0.04115,"percentile":0.90782,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9hx8-2mrv-r674","url":"https://osv.dev/vulnerability/GHSA-9hx8-2mrv-r674","summary":"Deserialization of Untrusted Data in Apache jUDDI","modified":"2023-11-08T04:06:18.699518Z","packages":[{"ecosystem":"Maven","name":"org.apache.juddi:juddi-core","purl":"pkg:maven/org.apache.juddi/juddi-core","ranges":["<3.3.10"],"fixed":["3.3.10"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}