What’s Vulnerable › Vulnerabilities

CVE-2021-3160

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-28 · updated 2026-06-17
• Weakness: CWE-502

Description

Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unsecure serialized Java object using a specially crafted HTTP request, resulting in an unauthenticated remote code execution on the server.

Affected products

• Aca Assuweb: 359.3

References

• https://www.aca.fr/solution/assurex-solution-gestion-des-contrats-assurance/
• https://www.digital.security/fr/sites/default/files/advisories/cert-ds_advisory_cve-2021-3160.txt
• https://www.aca.fr/solution/assurex-solution-gestion-des-contrats-assurance/
• https://www.digital.security/fr/sites/default/files/advisories/cert-ds_advisory_cve-2021-3160.txt

Get alerted when CVE-2021-3160 or the next vulnerability affects your stack