CVE-2021-3160 Deserialization in n/a
Remote attackers can achieve unauthenticated code execution on ACA ASSUREX RENTES servers by injecting malicious serialized Java objects via the login page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3160?
CVE-2021-3160 is a critical unsafe deserialization vulnerability in n/a, published on 28 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unsecure serialized Java object using a specially crafted HTTP request, resulting in an unauthenticated remote code execution on the server.
Weakness: CWE-502
Which versions are affected by CVE-2021-3160?
It affects 1 product.
Products include Aca Assuweb.
How do I fix CVE-2021-3160?
No fix has been published for CVE-2021-3160 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-3160 being exploited?
There is no known exploitation of CVE-2021-3160 in the wild and no public exploit code.
Sources
Also known as GHSA-4f4h-6cgm-pgpx.