Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:apache_software_foundation:apache_roller:*:*:*:*:*:*:*:*

1 brief RSS
critical advisory

Unauthenticated Remote Code Execution in Apache Roller via XML-RPC Deserialization

Apache Roller 6.1.5 is susceptible to unauthenticated remote code execution via insecure Java deserialization on the XML-RPC endpoint, which is triggered by an attacker-supplied 'ex:serializable' extension type before authentication is processed.

Apache Roller vulnerability rce deserialization apache-roller
1r 2t 1c