CVE-2021-39141

Scores

EPSS

0.818high81.8%
0%20%40%60%80%100%

Percentile: 81.8%

CVSS

8.5high3.x
0246810

CVSS Score: 8.5/10

All CVSS Scores

CVSS 3.x
8.5

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS 2.0
6.0

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream’s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-434

Vulnerable Software (26)

Type: Configuration

Product: libxstream-java

Operating System: ubuntu bionic 18.04

Trait:
{  "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu focal 20.04

Trait:
{  "fixed": "1.4.11.1-1ubuntu0.3"}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu hirsute 21.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu impish 21.10

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu jammy 22.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu kinetic 22.10

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu lunar 23.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu trusty 14.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: ubuntu xenial 16.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libxstream-java

Operating System: debian

Trait:
{  "fixed": "1.4.18-1"}

Source: debian

Type: Configuration

Product: xstream

Operating System: rhel 7

Trait:
{  "fixed": "1.3.1-16.el7_9"}

Source: redhat

Type: Configuration

Vendor: *

Product: business_activity_monitoring

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: commerce_guided_search

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_billing_and_revenue_management_elastic_charging_engine

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_cloud_native_core_automated_test_suite

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_cloud_native_core_binding_support_function

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_cloud_native_core_policy

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_unified_inventory_management

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:commerce_...

Source: nvd

Type: Configuration

Vendor: *

Product: debian_linux

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"...

Source: nvd

Type: Configuration

Vendor: *

Product: fedora

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",...

Source: nvd