title: Unsafe deserialization in Apache OFBiz
description: Apache OFBiz has unsafe deserialization prior to 17.12.07 version
problem types: Java serialisation
affected:
{
product: Apache OFBiz
vendor: Apache Software Foundation
versions:
lessThan: 17.12.07, status: affected, version: Apache OFBiz, versionType: custom
}
metrics:
other: [
content: {'other': 'High, possible RCE'}
type: unknown
]
workarounds: Upgrade to at least 17.12.07 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12212 & OFBIZ-12221