CVE-2021-39181

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-91

Affected software

Vendor	Product	Versions
OpenOLAT	OpenOLAT	< 15.3.18; >= 15.4.0, < 15.5.3

References

https://github.com/OpenOLAT/OpenOLAT/commit/3f219ac457afde82e3be57bc614352ab92c05684Patch, Third Party Advisory
https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-596v-3gwh-2m9wThird Party Advisory
https://jira.openolat.org/browse/OO-5548Permissions Required
https://github.com/OpenOLAT/OpenOLAT/commit/3f219ac457afde82e3be57bc614352ab92c05684Patch, Third Party Advisory
https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-596v-3gwh-2m9wThird Party Advisory
https://jira.openolat.org/browse/OO-5548Permissions Required

Timeline

Published: Sep 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391827.5EnroCrypt is a Python module for encryption and hashing. Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing fil CVE-2021-391836.1Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascrip CVE-2021-391848.6Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to CVE-2021-391859.1Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.CVE-2021-391866.1GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the usernam CVE-2021-391877.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Serve CVE-2021-391895.3Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the CVE-2021-39199.8A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege a CVE-2021-391905.3The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuratio CVE-2021-391916.1mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party,CVE-2021-391927.2Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows a CVE-2021-391935.3Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethe