CVE-2021-39141

Scores

EPSS

0.000none0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

8.5high3.x
0246810

CVSS Score: 8.5/10

All CVSS Scores

CVSS 3.x
8.5

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS 2.0
6.0

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream’s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdubuntu

CWEs

CWE-434

Vulnerable Software (25)

Type: Configuration

Product: libxstream-java

Operating System: ubuntu xenial 16.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu focal 20.04

Trait:
{  "fixed": "1.4.11.1-1ubuntu0.3"}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu trusty 14.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu lunar 23.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu kinetic 22.10

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu jammy 22.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: debian

Trait:
{  "fixed": "1.4.18-1"}

Source: debian

Type: Configuration

Product: libxstream-java

Operating System: ubuntu impish 21.10

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu hirsute 21.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu bionic 18.04

Trait:
{  "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"}

Source: ubuntu