Yüksek CVSS 8.8
CVE-2021-29505: Xstream: kod enjeksiyonu
Açıklama (NVD)
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
Özet bilgiler
- Ürün
- Xstream Xstream
- CVSS v3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %77,23 (yüzdelik 100)
- CWE
- CWE-94
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| xstream-xstream | — | — | 1.4.17 |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| fedoraproject-fedora | 33 | 33 | — |
| fedoraproject-fedora | 34 | 34 | — |
| fedoraproject-fedora | 35 | 35 | — |
| netapp-snapmanager | — | — | — |
| netapp-snapmanager | — | — | — |
| oracle-banking-cash-management | 14.2 | 14.2 | — |
| oracle-banking-cash-management | 14.3 | 14.3 | — |
| oracle-banking-cash-management | 14.5 | 14.5 | — |
| oracle-banking-corporate-lending-process-management | 14.2.0 | 14.2.0 | — |
| oracle-banking-corporate-lending-process-management | 14.3.0 | 14.3.0 | — |
| oracle-banking-corporate-lending-process-management | 14.5.0 | 14.5.0 | — |
| oracle-banking-credit-facilities-process-management | 14.2.0 | 14.2.0 | — |
| oracle-banking-credit-facilities-process-management | 14.3.0 | 14.3.0 | — |
| oracle-banking-credit-facilities-process-management | 14.5.0 | 14.5.0 | — |
| oracle-banking-supply-chain-finance | 14.2.0 | 14.2.0 | — |
| oracle-banking-trade-finance-process-management | 14.5.0 | 14.5.0 | — |
| oracle-business-activity-monitoring | 11.1.1.9.0 | 11.1.1.9.0 | — |
| oracle-business-activity-monitoring | 12.2.1.3.0 | 12.2.1.3.0 | — |
| oracle-business-activity-monitoring | 12.2.1.4.0 | 12.2.1.4.0 | — |
| oracle-communications-brm-elastic-charging-engine | 11.3 | 11.3 | — |
| oracle-communications-brm-elastic-charging-engine | 12.0 | 12.0 | — |
| oracle-communications-unified-inventory-management | 7.3.4 | 7.3.4 | — |
| oracle-communications-unified-inventory-management | 7.3.5 | 7.3.5 | — |
| oracle-communications-unified-inventory-management | 7.4.0 | 7.4.0 | — |
| oracle-communications-unified-inventory-management | 7.4.1 | 7.4.1 | — |
| oracle-communications-unified-inventory-management | 7.4.2 | 7.4.2 | — |
Kaynaklar
- NVD kaydı
- github.com
- github.com
- github.com
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- x-stream.github.io
- github.com
- github.com
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- www.debian.org
- CWE-94