CVE-2021-39181 Unsafe Deserialization of User Data Using XStream

What is CVE-2021-39181?

CVE-2021-39181 is a high-severity unsafe deserialization vulnerability in OpenOLAT, published on 1 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Weakness: CWE-91

Which versions are affected by CVE-2021-39181?

It affects 1 product.

Products include Frentix Openolat.

How do I fix CVE-2021-39181?

No fix has been published for CVE-2021-39181 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-39181 being exploited?

There is no known exploitation of CVE-2021-39181 in the wild and no public exploit code.

Other vulnerabilities in OpenOLAT

• CVE-2026-31946 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow Critical 9.8
• CVE-2026-28228 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution High 8.8
• CVE-2021-41242 Path Traversal in some REST methods leading to file upload to arbitrary places High 8.1
• CVE-2021-39180 Path Traversal in Archive Handling Leading to Code Execution High 8.1
• CVE-2021-41152 Path Traversal in Folder Component Leading to Local File Inclusion High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-596v-3gwh-2m9w.