CVE-2021-21345

Katalog CVE

CVSS 9.9 · Critical EPSS 72,3%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada netapp oncommand insight, apache activemq +14 lainnya. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-502: Deserialization of Untrusted Data
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

72,3% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory vendor
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://x-stream.github.io/security.html#workaround mitigasi · advisory pihak ketiga
• http://x-stream.github.io/changes.html#1.4.16 release notes · advisory pihak ketiga
• https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4 advisory pihak ketiga
• https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.acti... issue tracking · mailing list · advisory pihak ketiga
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter... issue tracking · mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210430-0002/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5004 mailing list · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html advisory pihak ketiga
• https://x-stream.github.io/CVE-2021-21345.html exploit · advisory pihak ketiga