Jacques Le Roux

The issue affects Apache OFBiz due to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This vulnerability may allow a remote attacker to execute arbitrary code, potentially leading to full system compromise. Approximately 841 devices may be affected.

The issue is related to unsafe deserialization, which can allow a remote attacker to execute arbitrary code by sending a specially crafted request. This can potentially lead to the recovery of unreliable data in memory.

The issue is related to unsafe deserialization in Apache OFBiz, allowing an unauthenticated attacker to take over the system. This can impact the confidentiality, integrity, and availability of protected information. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. A high severity remote code execution flaw in Apache OFBiz could have allowed attackers to take over the ERP system.

The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.