CVE-2021-39146High· 8.5▾ MidnightPoC availableXStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input st…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 46.8 · likelihood 2.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
14%
Nuclei ×1 (last check)
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
xstream < 1.4.18fedora = 33fedora = 34fedora = 35debian_linux = 9.0debian_linux = 10.0debian_linux = 11.0snapmanagerbusiness_activity_monitoring = 12.2.1.4.0commerce_guided_search = 11.3.2communications_billing_and_revenue_management_elastic_charging_engine = 11.3communications_billing_and_revenue_management_elastic_charging_engine = 12.0communications_cloud_native_core_automated_test_suite = 1.9.0communications_cloud_native_core_binding_support_function = 1.10.0communications_cloud_native_core_policy = 1.14.0communications_unified_inventory_management = 7.3.4communications_unified_inventory_management = 7.3.5communications_unified_inventory_management = 7.4.0communications_unified_inventory_management = 7.4.1communications_unified_inventory_management = 7.4.2retail_xstore_point_of_service = 16.0.6retail_xstore_point_of_service = 17.0.2retail_xstore_point_of_service = 18.0.3retail_xstore_point_of_service = 19.0.2retail_xstore_point_of_service = 20.0.1utilities_framework = 4.2.0.2.0utilities_framework = 4.2.0.3.0utilities_framework = 4.3.0.1.0utilities_framework = 4.3.0.6.0utilities_framework = 4.4.0.0.0utilities_framework = 4.4.0.2.0utilities_framework = 4.4.0.3.0utilities_testing_accelerator = 6.0.0.1.1webcenter_portal = 12.2.1.3.0webcenter_portal = 12.2.1.4.0Upgrade past the affected range:
xstream 1.4.18Connected by shared product, vendor, weakness, or advisory.
CVE-2021-39141High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39139High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39147High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39151High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39148High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39153High· 8.5XStream is a simple library to serialize objects to XML and back again