CVE-2021-29505High· 7.5▾ MidnightPoC availableXStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the proces…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 15.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
77%
2 GitHub repos · Nuclei ×1 (last check)
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
xstream < 1.4.17debian_linux = 9.0debian_linux = 10.0debian_linux = 11.0fedora = 33fedora = 34fedora = 35snapmanagerbanking_cash_management = 14.2banking_cash_management = 14.3banking_cash_management = 14.5banking_corporate_lending_process_management = 14.2.0banking_corporate_lending_process_management = 14.3.0banking_corporate_lending_process_management = 14.5.0banking_credit_facilities_process_management = 14.2.0banking_credit_facilities_process_management = 14.3.0banking_credit_facilities_process_management = 14.5.0banking_supply_chain_finance = 14.2.0banking_trade_finance_process_management = 14.5.0business_activity_monitoring = 11.1.1.9.0business_activity_monitoring = 12.2.1.3.0business_activity_monitoring = 12.2.1.4.0communications_brm_-_elastic_charging_engine = 11.3communications_brm_-_elastic_charging_engine = 12.0communications_unified_inventory_management = 7.3.4communications_unified_inventory_management = 7.3.5communications_unified_inventory_management = 7.4.0communications_unified_inventory_management = 7.4.1communications_unified_inventory_management = 7.4.2enterprise_manager_ops_center = 12.4.0.0retail_customer_insights = 15.0.2retail_customer_insights = 16.0.2retail_xstore_point_of_service = 16.0.6retail_xstore_point_of_service = 17.0.4retail_xstore_point_of_service = 18.0.3retail_xstore_point_of_service = 19.0.2retail_xstore_point_of_service = 20.0.1webcenter_portal = 12.2.1.3.0webcenter_portal = 12.2.1.4.0webcenter_sites = 12.2.1.3.0webcenter_sites = 12.2.1.4.0Upgrade past the affected range:
xstream 1.4.17Connected by shared product, vendor, weakness, or advisory.
CVE-2021-39152High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39146High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39141High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39139High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39147High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39150High· 8.5XStream is a simple library to serialize objects to XML and back again