CVE-2021-21342
CVSS V2 Medium 5.8
CVSS V3 Critical 9.1
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Overview
- CVE ID
- CVE-2021-21342
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-03-23T00:15:12
- Last Modified Date
- 2023-03-09T15:18:04
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:* | 1 | OR | 1.4.16 | |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 1 | OR | 8.0.27 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:P/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 5.8
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 4.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- NONE
- Base Score
- 9.1
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.2
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-21342 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21342 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 06:32:37 | Added to TrackCVE | |||
| 2022-12-06 00:11:05 | 2021-03-23T00:15Z | 2021-03-23T00:15:12 | CVE Published Date | updated |
| 2022-12-06 00:11:05 | 2022-02-16T14:50:09 | CVE Modified Date | updated | |
| 2022-12-06 00:11:05 | Analyzed | Vulnerability Status | updated | |
| 2023-03-09 17:12:34 | 2023-03-09T15:18:04 | CVE Modified Date | updated | |
| 2023-03-09 17:12:35 | Weakness Enumeration | update |