Yüksek CVSS 8.5 PoC var
CVE-2021-39154: Xstream: tehlikeli dosya yükleme
Açıklama (NVD)
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Özet bilgiler
- Ürün
- Xstream Xstream
- CVSS v3.1
- 8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- %4,74 (yüzdelik 92)
- CWE
- CWE-434
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| xstream-xstream | — | — | 1.4.18 |
| fedoraproject-fedora | 33 | 33 | — |
| fedoraproject-fedora | 34 | 34 | — |
| fedoraproject-fedora | 35 | 35 | — |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| netapp-snapmanager | — | — | — |
| netapp-snapmanager | — | — | — |
| oracle-business-activity-monitoring | 12.2.1.4.0 | 12.2.1.4.0 | — |
| oracle-commerce-guided-search | 11.3.2 | 11.3.2 | — |
| oracle-communications-billing-and-revenue-management-elastic-charging-engine | 11.3 | 11.3 | — |
| oracle-communications-billing-and-revenue-management-elastic-charging-engine | 12.0 | 12.0 | — |
| oracle-communications-cloud-native-core-automated-test-suite | 1.9.0 | 1.9.0 | — |
| oracle-communications-cloud-native-core-binding-support-function | 1.10.0 | 1.10.0 | — |
| oracle-communications-cloud-native-core-policy | 1.14.0 | 1.14.0 | — |
| oracle-communications-unified-inventory-management | 7.3.4 | 7.3.4 | — |
| oracle-communications-unified-inventory-management | 7.3.5 | 7.3.5 | — |
| oracle-communications-unified-inventory-management | 7.4.0 | 7.4.0 | — |
| oracle-communications-unified-inventory-management | 7.4.1 | 7.4.1 | — |
| oracle-communications-unified-inventory-management | 7.4.2 | 7.4.2 | — |
| oracle-retail-xstore-point-of-service | 16.0.6 | 16.0.6 | — |
| oracle-retail-xstore-point-of-service | 17.0.4 | 17.0.4 | — |
| oracle-retail-xstore-point-of-service | 18.0.3 | 18.0.3 | — |
| oracle-retail-xstore-point-of-service | 19.0.2 | 19.0.2 | — |
| oracle-retail-xstore-point-of-service | 20.0.1 | 20.0.1 | — |
| oracle-utilities-framework | 4.2.0.2.0 | 4.2.0.2.0 | — |
| oracle-utilities-framework | 4.2.0.3.0 | 4.2.0.3.0 | — |
| oracle-utilities-framework | 4.3.0.1.0 | 4.3.0.1.0 | — |
| oracle-utilities-framework | 4.3.0.6.0 | 4.3.0.6.0 | — |
Kaynaklar
- NVD kaydı
- github.com
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- x-stream.github.io
- github.com
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- x-stream.github.io
- CWE-434