CVE-2021-21342

Katalog CVE

CVSS 9.1 · Critical EPSS 50,0%

Kerentanan Deserialization of Untrusted Data pada netapp oncommand insight, apache activemq +13 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

50,0% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpujan2022.html not applicable · patch · advisory vendor
• https://x-stream.github.io/security.html#workaround mitigasi · advisory pihak ketiga
• http://x-stream.github.io/changes.html#1.4.16 release notes · advisory pihak ketiga
• https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m advisory pihak ketiga
• https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.acti... issue tracking · mailing list · advisory pihak ketiga
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter... issue tracking · mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210430-0002/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5004 mailing list · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html advisory pihak ketiga
• https://x-stream.github.io/CVE-2021-21342.html exploit · advisory pihak ketiga