CVE-2021-39181

Name of the Vulnerable Software and Affected Versions OpenOlat versions prior to 15.3.18, 15.5.3, and 16.0.0

Description OpenOlat is a web-based learning management system. The issue allows an attacker to execute arbitrary code using a prepared import XML file, such as a course, which can instantiate any class on the Java classpath, including spring AOP bean factories. This requires an OpenOlat user account with the authoring role and cannot be exploited by unregistered users.

Recommendations For versions prior to 15.3.18, upgrade to version 15.3.18 or later. For versions prior to 15.5.3, upgrade to version 15.5.3 or later. For versions prior to 16.0.0, upgrade to version 16.0.0 or later.