CVE-2021-21343
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
XStream before version 1.4.16 contains a vulnerability where the processed stream at unmarshalling time contains type information to recreate previously written objects. An attacker can manipulate the processed input stream and replace or inject objects, resulting in the deletion of a file on the local host.
Risk Assessment
Deletion of files on the local host may be possible, potentially leading to data loss or service disruption. The risk affects installations relying on the default blacklist instead of a whitelist.
Recommendation
Upgrade XStream to at least version 1.4.16 and configure the security framework with a whitelist limited to the minimal required types.
Other vulnerabilities in XStream
See all- CVE-2021-39152High
XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to request data from internal resources not publicly available by manipulating the processed input stream with Java runtime version 14 to 8. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. If relying on the default blacklist of the Security Framework, you must use at least version 1.4.18.
- CVE-2021-39140Medium
XStream, a library for serializing objects to and from XML, in affected versions may allow a remote attacker to allocate 100% CPU time on the target system by manipulating the processed input stream, resulting in a denial of service. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected.
- CVE-2021-39154High
XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
- CVE-2021-39153High
XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. Users who configured the security framework with a whitelist are not affected. Version 1.4.18 no longer uses a blacklist by default.
- CVE-2021-39151High
XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
- CVE-2021-39149High
XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
- CVE-2021-39148High
XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
- CVE-2021-39147High
XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
- CVE-2021-39146High
XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
- CVE-2021-39145High
XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.
Original NVD description (English source)
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS