Read the docs
TI-2021-16567 Aliases CVE-2021-39181

Unsafe Deserialization of User Data Using XStream

Priority MEDIUM 42CWE-91Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Why it matters now

EPSS 0.01909 79th percentileScored 2026-11-07
Fix Fixed OpenOLAT (OpenOLAT): 15.3.18, 15.5.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenOLATOpenOLATbefore 15.3.18; 15.4.0 to before 15.5.315.3.18, 15.5.3Patch availableCNA
  • OpenOLAT VendorOpenOLAT Affected before 15.3.18; 15.4.0 to before 15.5.3 Fixed in 15.3.18, 15.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*before 15.3.18; 15.5.0 to before 15.5.3VulnerableOpenOLAT
  • cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:* Versions before 15.3.18; 15.5.0 to before 15.5.3 Vulnerable ·OpenOLAT

Remediation

  • Fix · CNA OpenOLAT (OpenOLAT) Fixed in 15.3.18, 15.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39181

References

Patch 1

Advisory 1

Other 1

  • TI-2024-17072 Stored Cross-Site Scripting (XSS) within the Media Center CVSS 3.1MEDIUM 5.4
  • TI-2026-24492 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow CVSS 3.1CRITICAL 9.8
  • TI-2021-16566 Path Traversal in Archive Handling Leading to Code Execution CVSS 3.1HIGH 8.8
  • TI-2026-22563 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution CVSS 3.1HIGH 8.8
  • TI-2021-18077 Path Traversal in some REST methods leading to file upload to arbitrary places CVSS 3.1HIGH 8.1
  • TI-2021-17991 Path Traversal in Folder Component Leading to Local File Inclusion CVSS 3.1HIGH 7.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences