CVE-2021-39181: Unsafe Deserialization of User Data Using XStream

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-01 · updated 2026-06-17
Weakness: CWE-91

Description

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.

Affected products

OpenOLAT: before 15.3.18; from 15.5.0 before 15.5.3 — fixed in 15.3.18, 15.5.3

How to fix

Upgrade to a fixed version: OpenOLAT 15.3.18, 15.5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-39181 or the next vulnerability affects your stack