CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-2170
Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Severity
- EPSS
- 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:ofbiz
References
- http://ofbiz.apache.org/download.html#vulnerabilities
- http://packetstormsecurity.com/files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html
- http://www.securityfocus.com/archive/1/538034/100/0/threaded
- http://www.securitytracker.com/id/1035513
- https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04