CVE-2021-21344

Katalog CVE

CVSS 9.8 · Critical EPSS 76,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada netapp oncommand insight, apache activemq +14 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

76,0% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory vendor
• https://x-stream.github.io/security.html#workaround mitigasi · advisory pihak ketiga
• http://x-stream.github.io/changes.html#1.4.16 release notes · advisory pihak ketiga
• https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3 advisory pihak ketiga
• https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.acti... issue tracking · mailing list · advisory pihak ketiga
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter... issue tracking · mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210430-0002/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5004 mailing list · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html advisory pihak ketiga
• https://x-stream.github.io/CVE-2021-21344.html exploit · advisory pihak ketiga