CVE-2021-39144
Known Exploited (CISA KEV)HIGH
8.5
CVSS Severity Score
Vulnerability Description
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected Platforms (CPE)
📦
Xstream
Xstream
< 1.4.18💻
Debian
Debian Linux
= 9.0💻
Debian
Debian Linux
= 10.0💻
Debian
Debian Linux
= 11.0💻
Fedoraproject
Fedora
= 33💻
Fedoraproject
Fedora
= 34💻
Fedoraproject
Fedora
= 35📦
Netapp
Snapmanager
All versions📦
Netapp
Snapmanager
All versions📦
Oracle
Business Activity Monitoring
= 12.2.1.4.0📦
Oracle
Commerce Guided Search
= 11.3.2📦
Oracle
Communications Billing And Revenue Management Elastic Charging Engine
= 11.3📦
Oracle
Communications Billing And Revenue Management Elastic Charging Engine
= 12.0📦
Oracle
Communications Cloud Native Core Automated Test Suite
= 1.9.0📦
Oracle
Communications Cloud Native Core Binding Support Function
= 1.10.0📦
Oracle
Communications Cloud Native Core Policy
= 1.14.0📦
Oracle
Communications Unified Inventory Management
= 7.3.4📦
Oracle
Communications Unified Inventory Management
= 7.3.5📦
Oracle
Communications Unified Inventory Management
= 7.4.0📦
Oracle
Communications Unified Inventory Management
= 7.4.1📦
Oracle
Communications Unified Inventory Management
= 7.4.2📦
Oracle
Retail Xstore Point Of Service
= 16.0.6📦
Oracle
Retail Xstore Point Of Service
= 17.0.4📦
Oracle
Retail Xstore Point Of Service
= 18.0.3📦
Oracle
Retail Xstore Point Of Service
= 19.0.2📦
Oracle
Retail Xstore Point Of Service
= 20.0.1📦
Oracle
Utilities Framework
= 4.2.0.2.0📦
Oracle
Utilities Framework
= 4.2.0.3.0📦
Oracle
Utilities Framework
= 4.3.0.1.0📦
Oracle
Utilities Framework
= 4.3.0.6.0📦
Oracle
Utilities Framework
= 4.4.0.0.0📦
Oracle
Utilities Framework
= 4.4.0.2.0📦
Oracle
Utilities Framework
= 4.4.0.3.0📦
Oracle
Utilities Testing Accelerator
= 6.0.0.1.1📦
Oracle
Webcenter Portal
= 12.2.1.3.0📦
Oracle