CVE-2021-21349

Exploit

EPSS 46.83%
Veröffentlicht 23.03.2021 00:15:13
Zuletzt bearbeitet 07.10.2026 19:17:24
Erkennungen
Login

A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 2 Referenzen 18

NVD 42 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Netapp ≫ Oncommand Insight Version -

Apache ≫ Activemq Version < 5.15.14

Apache ≫ Activemq Version 5.16.0

Apache ≫ Activemq Version 5.16.1

Apache ≫ Jmeter Version < 5.5

Xstream ≫ Xstream Version < 1.4.16

Debian ≫ Debian Linux Version 9.0

Debian ≫ Debian Linux Version 10.0

Debian ≫ Debian Linux Version 11.0

Fedoraproject ≫ Fedora Version 33

Fedoraproject ≫ Fedora Version 34

Fedoraproject ≫ Fedora Version 35

Oracle ≫ Banking Enterprise Default Management Version 2.10.0

Oracle ≫ Banking Enterprise Default Management Version 2.12.0

Oracle ≫ Banking Platform Version 2.4.0

Oracle ≫ Banking Platform Version 2.7.1

Oracle ≫ Banking Platform Version 2.9.0

Oracle ≫ Banking Platform Version 2.12.0

Oracle ≫ Banking Virtual Account Management Version 14.2.0

Oracle ≫ Banking Virtual Account Management Version 14.3.0

Oracle ≫ Banking Virtual Account Management Version 14.5.0

Oracle ≫ Business Activity Monitoring Version 11.1.1.9.0

Oracle ≫ Business Activity Monitoring Version 12.2.1.3.0

Oracle ≫ Business Activity Monitoring Version 12.2.1.4.0

Oracle ≫ Communications Billing And Revenue Management Elastic Charging Engine Version 12.0.0.3.0

Oracle ≫ Communications Policy Management Version 12.5.0

Oracle ≫ Communications Unified Inventory Management Version 7.3.2

Oracle ≫ Communications Unified Inventory Management Version 7.3.4

Oracle ≫ Communications Unified Inventory Management Version 7.3.5

Oracle ≫ Communications Unified Inventory Management Version 7.4.0

Oracle ≫ Communications Unified Inventory Management Version 7.4.1

Oracle ≫ Graalvm Version 20.3.4 SwEdition enterprise

Oracle ≫ Graalvm Version 21.3.0 SwEdition enterprise

Oracle ≫ Java Se Version 7u321

Oracle ≫ Java Se Version 8u311

Oracle ≫ Retail Xstore Point Of Service Version 16.0.6

Oracle ≫ Retail Xstore Point Of Service Version 17.0.4

Oracle ≫ Retail Xstore Point Of Service Version 18.0.3

Oracle ≫ Retail Xstore Point Of Service Version 19.0.2

Oracle ≫ Webcenter Portal Version 11.1.1.9.0

Oracle ≫ Webcenter Portal Version 12.2.1.3.0

Oracle ≫ Webcenter Portal Version 12.2.1.4.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	46.83%	0.987

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.6	3.9	4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
security-advisories@github.com	6.1	1.6	4	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://www.oracle.com/security-alerts/cpujan2022.html

Patch

Vendor Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Third Party Advisory

http://x-stream.github.io/changes.html#1.4.16

Third Party Advisory

Release Notes

https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20210430-0002/

Third Party Advisory

https://www.debian.org/security/2021/dsa-5004

Third Party Advisory

Mailing List

https://x-stream.github.io/security.html#workaround

Third Party Advisory

Mitigation

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/

Third Party Advisory

Mailing List

https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E

Third Party Advisory

Mailing List

Issue Tracking

https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E

Third Party Advisory

Mailing List

Issue Tracking

https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv

Third Party Advisory

https://x-stream.github.io/CVE-2021-21349.html

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2021-21349

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-21349

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-21349

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2021-21349