[CVE-2021-37608] Arbitrary file upload vulnerability in OFBiz

["jleroux () apache org" <jleroux () apache org>]

Severity:
High, possible RCE

Vendor:
The Apache Software Foundation

Versions Affected:
OFBiz versions prior to 17.12.08

Description:
Apache OFBiz has unsafe deserialization prior to 17.12.08 version

Mitigation:
Upgrade to at least 17.12.08
or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297

Credit:
Zhujie from galaxylab <galaxylab () sina com>

References:
http://ofbiz.apache.org/download.html#vulnerabilities