title: RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
description: Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
problem types: Java serialisation
affected:
{
product: Apache OFBiz
vendor: Apache Software Foundation
versions:
status: affected, version: Apache OFBiz 17.12.01 to 17.12.05
}
workarounds: Upgrade to at least 17.12.06 or apply the patch at https://github.com/apache/ofbiz-framework/commit/af9ed4e/