Kritik CVSS 9.1 PoC var
CVE-2021-21351: Oncommand Insight: tehlikeli dosya yükleme
Açıklama (NVD)
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Özet bilgiler
- Ürün
- Netapp Oncommand Insight
- CVSS v3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS
- %82,14 (yüzdelik 100)
- CWE
- CWE-434
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| netapp-oncommand-insight | — | — | — |
| apache-activemq | — | — | 5.15.14 |
| apache-activemq | 5.16.0 | 5.16.0 | — |
| apache-activemq | 5.16.1 | 5.16.1 | — |
| apache-jmeter | — | — | 5.5 |
| xstream-xstream | — | — | 1.4.16 |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| fedoraproject-fedora | 33 | 33 | — |
| fedoraproject-fedora | 34 | 34 | — |
| fedoraproject-fedora | 35 | 35 | — |
| oracle-banking-enterprise-default-management | 2.10.0 | 2.10.0 | — |
| oracle-banking-enterprise-default-management | 2.12.0 | 2.12.0 | — |
| oracle-banking-platform | 2.4.0 | 2.4.0 | — |
| oracle-banking-platform | 2.7.1 | 2.7.1 | — |
| oracle-banking-platform | 2.9.0 | 2.9.0 | — |
| oracle-banking-platform | 2.12.0 | 2.12.0 | — |
| oracle-banking-virtual-account-management | 14.2.0 | 14.2.0 | — |
| oracle-banking-virtual-account-management | 14.3.0 | 14.3.0 | — |
| oracle-banking-virtual-account-management | 14.5.0 | 14.5.0 | — |
| oracle-business-activity-monitoring | 11.1.1.9.0 | 11.1.1.9.0 | — |
| oracle-business-activity-monitoring | 12.2.1.3.0 | 12.2.1.3.0 | — |
| oracle-business-activity-monitoring | 12.2.1.4.0 | 12.2.1.4.0 | — |
| oracle-communications-billing-and-revenue-management-elastic-charging-engine | 12.0.0.3.0 | 12.0.0.3.0 | — |
| oracle-communications-policy-management | 12.5.0 | 12.5.0 | — |
| oracle-communications-unified-inventory-management | 7.3.2 | 7.3.2 | — |
| oracle-communications-unified-inventory-management | 7.3.4 | 7.3.4 | — |
| oracle-communications-unified-inventory-management | 7.3.5 | 7.3.5 | — |
| oracle-communications-unified-inventory-management | 7.4.0 | 7.4.0 | — |
Kaynaklar
- NVD kaydı
- x-stream.github.io
- github.com
- lists.apache.org
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- x-stream.github.io
- x-stream.github.io
- x-stream.github.io
- github.com
- lists.apache.org
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- CWE-434