CVE-2021-21350Medium· 5.3▾ SunlitXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream.…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
15%
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
oncommand_insightactivemq < 5.15.14activemq = 5.16.0activemq = 5.16.1jmeter < 5.5xstream < 1.4.16debian_linux = 9.0debian_linux = 10.0debian_linux = 11.0fedora = 33fedora = 34fedora = 35banking_enterprise_default_management = 2.10.0banking_enterprise_default_management = 2.12.0banking_platform = 2.4.0banking_platform = 2.7.1banking_platform = 2.9.0banking_platform = 2.12.0banking_virtual_account_management = 14.2.0banking_virtual_account_management = 14.3.0banking_virtual_account_management = 14.5.0business_activity_monitoring = 11.1.1.9.0business_activity_monitoring = 12.2.1.3.0business_activity_monitoring = 12.2.1.4.0communications_billing_and_revenue_management_elastic_charging_engine = 12.0.0.3.0communications_policy_management = 12.5.0communications_unified_inventory_management = 7.3.2communications_unified_inventory_management = 7.3.4communications_unified_inventory_management = 7.3.5communications_unified_inventory_management = 7.4.0communications_unified_inventory_management = 7.4.1retail_xstore_point_of_service = 16.0.6retail_xstore_point_of_service = 17.0.4retail_xstore_point_of_service = 18.0.3retail_xstore_point_of_service = 19.0.2webcenter_portal = 11.1.1.9.0webcenter_portal = 12.2.1.3.0webcenter_portal = 12.2.1.4.0weblogic_server = 12.1.3.0.0weblogic_server = 12.2.1.3.0weblogic_server = 12.2.1.4.0weblogic_server = 14.1.1.0.0Upgrade past the affected range:
activemq 5.15.14jmeter 5.5xstream 1.4.16Connected by shared product, vendor, weakness, or advisory.
CVE-2021-21351Medium· 5.4XStream is a Java library to serialize objects to XML and back again
CVE-2021-21344Medium· 5.3XStream is a Java library to serialize objects to XML and back again
CVE-2021-21346Medium· 6.1XStream is a Java library to serialize objects to XML and back again
CVE-2021-21347Medium· 6.1XStream is a Java library to serialize objects to XML and back again
CVE-2021-21348Medium· 5.3XStream is a Java library to serialize objects to XML and back again
CVE-2021-21349Medium· 6.1XStream is a Java library to serialize objects to XML and back again