CVE-2021-37578

Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.

• CWE-502
• CWE-502

• http://www.openwall.com/lists/oss-security/2021/07/29/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r82047b3ba774cf870ea8e1e9ec51c6107f6cd056d4e36608148c6e71%40%3Cprivate.juddi.apache.org%3EBroken Link, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/07/29/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r82047b3ba774cf870ea8e1e9ec51c6107f6cd056d4e36608148c6e71%40%3Cprivate.juddi.apache.org%3EBroken Link, Mailing List, Third Party Advisory

Published

Jul 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37570MediaTek microchips, as used in NETGEAR devices through 2021…7.5
• CVE-2021-37571MediaTek microchips, as used in NETGEAR devices through 2021…8.8
• CVE-2021-37572MediaTek microchips, as used in NETGEAR devices through 2021…7.5
• CVE-2021-37573A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2021-37576arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5…7.8
• CVE-2021-37577Bluetooth LE and BR/EDR Secure Connections pairing and Secur…6.8
• CVE-2021-37579The Dubbo Provider will check the incoming request and the c…9.8
• CVE-2021-3758bookstack is vulnerable to Server-Side Request Forgery (SSRF…6.5
• CVE-2021-37580A flaw was found in Apache ShenYu Admin. The incorrect use o…9.8
• CVE-2021-37583MediaTek microchips, as used in NETGEAR devices through 2021…8.8
• CVE-2021-37584MediaTek microchips, as used in NETGEAR devices through 2021…8.8
• CVE-2021-37586The PowerPlay Web component of Mitel Interaction Recording M…4.9