CVE-2021-39144

HIGHCISA KEV

8.5

Descricao

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Detalhes CVE

Pontuacao CVSS v3.18.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado8/23/2021

Ultima modificacao10/24/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorXStream

ProdutoXStream

Nome da vulnerabilidadeXStream Remote Code Execution Vulnerability

Data inclusao KEV2023-03-10

Prazo de remediacao2023-03-31

Uso em ransomwareUnknown

Produtos afetados

debian:debian_linuxfedoraproject:fedoranetapp:snapmanageroracle:business_activity_monitoringoracle:commerce_guided_searchoracle:communications_billing_and_revenue_management_elastic_charging_engineoracle:communications_cloud_native_core_automated_test_suiteoracle:communications_cloud_native_core_binding_support_functionoracle:communications_cloud_native_core_policyoracle:communications_unified_inventory_managementoracle:retail_xstore_point_of_serviceoracle:utilities_frameworkoracle:utilities_testing_acceleratororacle:webcenter_portalxstream:xstream

Fraquezas (CWE)

CWE-94CWE-502CWE-306CWE-502

Referencias

http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html(security-advisories@github.com)

https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh(security-advisories@github.com)

https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/(security-advisories@github.com)

https://security.netapp.com/advisory/ntap-20210923-0003/(security-advisories@github.com)

https://www.debian.org/security/2021/dsa-5004(security-advisories@github.com)

https://www.oracle.com/security-alerts/cpuapr2022.html(security-advisories@github.com)

https://www.oracle.com/security-alerts/cpujan2022.html(security-advisories@github.com)

https://www.oracle.com/security-alerts/cpujul2022.html(security-advisories@github.com)

https://x-stream.github.io/CVE-2021-39144.html(security-advisories@github.com)

http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20210923-0003/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2021/dsa-5004(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujul2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://x-stream.github.io/CVE-2021-39144.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39144(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.