Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2021-39144

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS v3:

  • Severity: High
  • Score: 8.5
  • AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6
  • AV:N/AC:M/Au:S/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
debian / debian_linux 9.0 9.0.x
debian / debian_linux 10.0 10.0.x
debian / debian_linux 11.0 11.0.x
fedoraproject / fedora 33 33.x
fedoraproject / fedora 34 34.x
fedoraproject / fedora 35 35.x
oracle / webcenter_portal 12.2.1.3.0 12.2.1.3.0.x
oracle / utilities_framework 4.2.0.3.0 4.2.0.3.0.x
oracle / utilities_framework 4.2.0.2.0 4.2.0.2.0.x
oracle / utilities_framework 4.3.0.6.0 4.3.0.6.0.x
oracle / utilities_framework 4.4.0.0.0 4.4.0.0.0.x
oracle / communications_unified_inventory_management 7.3.4 7.3.4.x
oracle / communications_unified_inventory_management 7.3.5 7.3.5.x
oracle / communications_unified_inventory_management 7.4.0 7.4.0.x
oracle / webcenter_portal 12.2.1.4.0 12.2.1.4.0.x
oracle / utilities_framework 4.4.0.2.0 4.4.0.2.0.x
oracle / communications_billing_and_revenue_management_elastic_charging_engine 11.3 11.3.x
oracle / communications_billing_and_revenue_management_elastic_charging_engine 12.0 12.0.x
oracle / business_activity_monitoring 12.2.1.4.0 12.2.1.4.0.x
oracle / commerce_guided_search 11.3.2 11.3.2.x
oracle / communications_unified_inventory_management 7.4.1 7.4.1.x
oracle / retail_xstore_point_of_service 16.0.6 16.0.6.x
oracle / retail_xstore_point_of_service 17.0.4 17.0.4.x
oracle / retail_xstore_point_of_service 18.0.3 18.0.3.x
oracle / retail_xstore_point_of_service 19.0.2 19.0.2.x
oracle / retail_xstore_point_of_service 20.0.1 20.0.1.x
oracle / utilities_framework 4.4.0.3.0 4.4.0.3.0.x
oracle / utilities_testing_accelerator 6.0.0.1.1 6.0.0.1.1.x
oracle / communications_cloud_native_core_binding_support_function 1.10.0 1.10.0.x
oracle / utilities_framework 4.3.0.1.0 4.3.0.1.0.x
oracle / communications_cloud_native_core_policy 1.14.0 1.14.0.x
oracle / communications_unified_inventory_management 7.4.2 7.4.2.x
oracle / communications_cloud_native_core_automated_test_suite 1.9.0 1.9.0.x
com.thoughtworks.xstream / xstream - 1.4.18
xstream / xstream - 1.4.18