rewindex

RewindexCVEs

CVE-2021-39144: XStream is vulnerable to a Remote Command Execution attack

High · CVSS 8.5 (CVSS 3.1)KEV known exploitedEPSS 98.1%, 100th percentilePublished Updated Assigner: GitHub_M

In CISA’s Known Exploited Vulnerabilities catalog: XStream Remote Code Execution Vulnerability.

Added , federal remediation due . Known ransomware use: Unknown.

Required action: Apply updates per vendor instructions.

Description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H · CWE-502, CWE-94

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

x-stream: xstream

References

All CVEsMarkdownJSON