CVE-2021-39150High· 8.5▾ TwilightXStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.4%
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18.
xstream < 1.4.18fedora = 33fedora = 34fedora = 35debian_linux = 9.0debian_linux = 10.0debian_linux = 11.0snapmanagerbusiness_activity_monitoring = 12.2.1.4.0commerce_guided_search = 11.3.2communications_billing_and_revenue_management_elastic_charging_engine = 11.3communications_billing_and_revenue_management_elastic_charging_engine = 12.0communications_cloud_native_core_automated_test_suite = 1.9.0communications_cloud_native_core_binding_support_function = 1.10.0communications_cloud_native_core_policy = 1.14.0communications_unified_inventory_management = 7.3.4communications_unified_inventory_management = 7.3.5communications_unified_inventory_management = 7.4.0communications_unified_inventory_management = 7.4.1communications_unified_inventory_management = 7.4.2retail_xstore_point_of_service = 16.0.6retail_xstore_point_of_service = 17.0.4retail_xstore_point_of_service = 18.0.3retail_xstore_point_of_service = 19.0.2retail_xstore_point_of_service = 20.0.1utilities_framework = 4.2.0.2.0utilities_framework = 4.2.0.3.0utilities_framework = 4.3.0.1.0utilities_framework = 4.3.0.6.0utilities_framework = 4.4.0.0.0utilities_framework = 4.4.0.2.0utilities_framework = 4.4.0.3.0utilities_testing_accelerator = 6.0.0.1.1webcenter_portal = 12.2.1.3.0webcenter_portal = 12.2.1.4.0Upgrade past the affected range:
xstream 1.4.18Connected by shared product, vendor, weakness, or advisory.
CVE-2021-39152High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39139High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39147High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39140Medium· 6.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-39151High· 8.5XStream is a simple library to serialize objects to XML and back again
CVE-2021-29505High· 7.5XStream is software for serializing Java objects to XML and back again