Lucene search

GitHub_MCVE-2021-21347

HistoryMar 23, 2021 - 12:15 a.m.

CVE-2021-21347

2021-03-2300:15:13

CWE-502

CWE-434

GitHub_M

web.nvd.nist.gov

237

xstream

java

library

vulnerability

remote code execution

cve-2021-21347

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.018

Percentile

88.3%

JSON

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream’s security framework with a whitelist limited to the minimal required types. If you rely on XStream’s default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Affected configurations

Nvd

Vulners

Node

xstream_projectxstreamRange<1.4.16

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

fedoraprojectfedoraMatch33

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

Node

oraclebanking_enterprise_default_managementMatch2.10.0

oraclebanking_enterprise_default_managementMatch2.12.0

oraclebanking_platformMatch2.4.0

oraclebanking_platformMatch2.7.1

oraclebanking_platformMatch2.9.0

oraclebanking_platformMatch2.12.0

oraclebanking_virtual_account_managementMatch14.2.0

oraclebanking_virtual_account_managementMatch14.3.0

oraclebanking_virtual_account_managementMatch14.5.0

oraclebusiness_activity_monitoringMatch11.1.1.9.0

oraclebusiness_activity_monitoringMatch12.2.1.3.0

oraclebusiness_activity_monitoringMatch12.2.1.4.0

oraclecommunications_billing_and_revenue_management_elastic_charging_engineMatch12.0.0.3.0

oraclecommunications_policy_managementMatch12.5.0

oraclecommunications_unified_inventory_managementMatch7.3.2

oraclecommunications_unified_inventory_managementMatch7.3.4

oraclecommunications_unified_inventory_managementMatch7.3.5

oraclecommunications_unified_inventory_managementMatch7.4.0

oraclecommunications_unified_inventory_managementMatch7.4.1

oracleretail_xstore_point_of_serviceMatch16.0.6

oracleretail_xstore_point_of_serviceMatch17.0.4

oracleretail_xstore_point_of_serviceMatch18.0.3

oracleretail_xstore_point_of_serviceMatch19.0.2

oraclewebcenter_portalMatch11.1.1.9.0

oraclewebcenter_portalMatch12.2.1.3.0

oraclewebcenter_portalMatch12.2.1.4.0

oracleweblogic_serverMatch12.1.3.0.0

oracleweblogic_serverMatch12.2.1.3.0

oracleweblogic_serverMatch12.2.1.4.0

oracleweblogic_serverMatch14.1.1.0.0

VendorProductVersionCPE
xstream_projectxstream*cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
fedoraprojectfedora33cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
fedoraprojectfedora34cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
oraclebanking_enterprise_default_management2.10.0cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*
oraclebanking_enterprise_default_management2.12.0cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*
oraclebanking_platform2.4.0cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xstream_project	xstream	*	cpe:2.3:a:xstream_project:xstream::::::::
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
fedoraproject	fedora	33	cpe:2.3:o:fedoraproject:fedora:33:::::::*
fedoraproject	fedora	34	cpe:2.3:o:fedoraproject:fedora:34:::::::*
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
oracle	banking_enterprise_default_management	2.10.0	cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:::::::*
oracle	banking_enterprise_default_management	2.12.0	cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:::::::*
oracle	banking_platform	2.4.0	cpe:2.3:a:oracle:banking_platform:2.4.0:::::::*

Rows per page:

1-10 of 371

CNA Affected

[
  {
    "product": "xstream",
    "vendor": "x-stream",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.4.16"
      }
    ]
  }
]