Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2021-39147

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS v3:

  • Severity: High
  • Score: 8.5
  • AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6
  • AV:N/AC:M/Au:S/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
fedoraproject / fedora 33 33.x
fedoraproject / fedora 34 34.x
fedoraproject / fedora 35 35.x
debian / debian_linux 9.0 9.0.x
debian / debian_linux 10.0 10.0.x
debian / debian_linux 11.0 11.0.x
oracle / webcenter_portal 12.2.1.3.0 12.2.1.3.0.x
oracle / utilities_framework 4.2.0.3.0 4.2.0.3.0.x
oracle / utilities_framework 4.2.0.2.0 4.2.0.2.0.x
oracle / utilities_framework 4.3.0.6.0 4.3.0.6.0.x
oracle / utilities_framework 4.4.0.0.0 4.4.0.0.0.x
oracle / communications_unified_inventory_management 7.3.4 7.3.4.x
oracle / communications_unified_inventory_management 7.3.5 7.3.5.x
oracle / communications_unified_inventory_management 7.4.0 7.4.0.x
oracle / webcenter_portal 12.2.1.4.0 12.2.1.4.0.x
oracle / utilities_framework 4.4.0.2.0 4.4.0.2.0.x
oracle / communications_billing_and_revenue_management_elastic_charging_engine 11.3 11.3.x
oracle / communications_billing_and_revenue_management_elastic_charging_engine 12.0 12.0.x
oracle / business_activity_monitoring 12.2.1.4.0 12.2.1.4.0.x
oracle / commerce_guided_search 11.3.2 11.3.2.x
oracle / communications_unified_inventory_management 7.4.1 7.4.1.x
oracle / retail_xstore_point_of_service 16.0.6 16.0.6.x
oracle / retail_xstore_point_of_service 17.0.4 17.0.4.x
oracle / retail_xstore_point_of_service 18.0.3 18.0.3.x
oracle / retail_xstore_point_of_service 19.0.2 19.0.2.x
oracle / retail_xstore_point_of_service 20.0.1 20.0.1.x
oracle / utilities_framework 4.4.0.3.0 4.4.0.3.0.x
oracle / utilities_testing_accelerator 6.0.0.1.1 6.0.0.1.1.x
oracle / communications_cloud_native_core_binding_support_function 1.10.0 1.10.0.x
oracle / utilities_framework 4.3.0.1.0 4.3.0.1.0.x
oracle / communications_cloud_native_core_policy 1.14.0 1.14.0.x
oracle / communications_unified_inventory_management 7.4.2 7.4.2.x
oracle / communications_cloud_native_core_automated_test_suite 1.9.0 1.9.0.x
com.thoughtworks.xstream / xstream - 1.4.18
xstream / xstream - 1.4.18