Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Published

2021-03-23T00:15:13.193

Last Modified

2025-05-23T17:42:48.900

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-502
CWE-918
Type: Primary
CWE-918

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	netapp	oncommand_insight	-	Yes
Application	apache	activemq	< 5.15.14	Yes
Application	apache	activemq	5.16.0	Yes
Application	apache	activemq	5.16.1	Yes
Application	apache	jmeter	< 5.5	Yes
Application	xstream	xstream	< 1.4.16	Yes
Operating System	debian	debian_linux	9.0	Yes
Operating System	debian	debian_linux	10.0	Yes
Operating System	debian	debian_linux	11.0	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	fedoraproject	fedora	34	Yes
Operating System	fedoraproject	fedora	35	Yes
Application	oracle	banking_enterprise_default_management	2.10.0	Yes
Application	oracle	banking_enterprise_default_management	2.12.0	Yes
Application	oracle	banking_platform	2.4.0	Yes
Application	oracle	banking_platform	2.7.1	Yes
Application	oracle	banking_platform	2.9.0	Yes
Application	oracle	banking_platform	2.12.0	Yes
Application	oracle	banking_virtual_account_management	14.2.0	Yes
Application	oracle	banking_virtual_account_management	14.3.0	Yes
Application	oracle	banking_virtual_account_management	14.5.0	Yes
Application	oracle	business_activity_monitoring	11.1.1.9.0	Yes
Application	oracle	business_activity_monitoring	12.2.1.3.0	Yes
Application	oracle	business_activity_monitoring	12.2.1.4.0	Yes
Application	oracle	communications_billing_and_revenue_management_elastic_charging_engine	12.0.0.3.0	Yes
Application	oracle	communications_policy_management	12.5.0	Yes
Application	oracle	communications_unified_inventory_management	7.3.2	Yes
Application	oracle	communications_unified_inventory_management	7.3.4	Yes
Application	oracle	communications_unified_inventory_management	7.3.5	Yes
Application	oracle	communications_unified_inventory_management	7.4.0	Yes
Application	oracle	communications_unified_inventory_management	7.4.1	Yes
Application	oracle	graalvm	20.3.4	Yes
Application	oracle	graalvm	21.3.0	Yes
Application	oracle	java_se	7u321	Yes
Application	oracle	java_se	8u311	Yes
Application	oracle	retail_xstore_point_of_service	16.0.6	Yes
Application	oracle	retail_xstore_point_of_service	17.0.4	Yes
Application	oracle	retail_xstore_point_of_service	18.0.3	Yes
Application	oracle	retail_xstore_point_of_service	19.0.2	Yes
Application	oracle	webcenter_portal	11.1.1.9.0	Yes
Application	oracle	webcenter_portal	12.2.1.3.0	Yes
Application	oracle	webcenter_portal	12.2.1.4.0	Yes

References

http://x-stream.github.io/changes.html#1.4.16 Release Notes, Third Party Advisory ([email protected])
https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv Third Party Advisory ([email protected])
https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E Third Party Advisory, Issue Tracking, Mailing List ([email protected])
https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E Third Party Advisory, Issue Tracking, Mailing List ([email protected])
https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html Mailing List, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ Third Party Advisory, Mailing List ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ Third Party Advisory, Mailing List ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ Third Party Advisory, Mailing List ([email protected])
https://security.netapp.com/advisory/ntap-20210430-0002/ Third Party Advisory ([email protected])
https://www.debian.org/security/2021/dsa-5004 Third Party Advisory, Mailing List ([email protected])
https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpujan2022.html Patch, Vendor Advisory ([email protected])
https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory ([email protected])
https://x-stream.github.io/CVE-2021-21349.html Exploit, Third Party Advisory ([email protected])
https://x-stream.github.io/security.html#workaround Mitigation, Third Party Advisory ([email protected])
http://x-stream.github.io/changes.html#1.4.16 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E Third Party Advisory, Issue Tracking, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E Third Party Advisory, Issue Tracking, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ Third Party Advisory, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ Third Party Advisory, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ Third Party Advisory, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20210430-0002/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2021/dsa-5004 Third Party Advisory, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujan2022.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://x-stream.github.io/CVE-2021-21349.html Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://x-stream.github.io/security.html#workaround Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)