CVE-2021-29505
Published May 28, 2021
Last updated a year ago
Overview
- Description
- XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
- Source
- security-advisories@github.com
- NVD status
- Modified
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.5
- Impact score
- 6.4
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:P
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B52FEE1-8DD4-470E-BB3E-AEB351910103",
"versionEndExcluding": "1.4.17"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
"vulnerable": true,
"matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF"
},
{
"criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
"vulnerable": true,
"matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3DBD5E57-CC8B-4180-ACBD-BD067D0801D2"
},
{
"criteria": "cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "071E67EC-DC5A-4BD1-AC8F-6266E6436FF0"
},
{
"criteria": "cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "626C6209-8BC3-4954-BF0C-51500582457E"
},
{
"criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CF9A061-2421-426D-9854-0A4E55B2961D"
},
{
"criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F95EDC3D-54BB-48F9-82F2-7CCF335FCA78"
},
{
"criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B72B735F-4E52-484A-9C2C-23E6E2070385"
},
{
"criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B36A1D4-F391-4EE3-9A65-0A10568795BA"
},
{
"criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55116032-AAD1-4FEA-9DA8-2C4CBD3D3F61"
},
{
"criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0275F820-40BE-47B8-B167-815A55DF578E"
},
{
"criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A8420D4-AAF1-44AA-BF28-48EE3ED310B9"
},
{
"criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B185C1EA-71E6-4972-8637-08A33CC00841"
},
{
"criteria": "cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC723E79-8F35-417B-B9D9-6A707F74C1EE"
},
{
"criteria": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5700C2E9-5FF2-48EF-AD85-3C03EDA76536"
},
{
"criteria": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA8461A2-428C-4817-92A9-0C671545698D"
},
{
"criteria": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "512E0604-4D40-49CE-8142-89379A226913"
},
{
"criteria": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5726AE4-4F63-4793-8948-0546DAA2D50D"
},
{
"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D299528-8EF0-49AF-9BDE-4B6C6B1DA36C"
},
{
"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17A91FD9-9F77-42D3-A4D9-48BC7568ADE1"
},
{
"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "539DA24F-E3E0-4455-84C6-A9D96CD601B3"
},
{
"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7637F8B-15F1-42E2-BE18-E1FF7C66587D"
},
{
"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E43D793A-7756-4D58-A8ED-72DC4EC9CEA7"
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B095CC03-7077-4A58-AB25-CC5380CDCE5A"
},
{
"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "490B2C44-CECD-4551-B04F-4076D0E053C7"
},
{
"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEC41EB8-73B4-4BDF-9321-F34EC0BAF9E6"
},
{
"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48EFC111-B01B-4C34-87E4-D6B2C40C0122"
},
{
"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "073FEA23-E46A-4C73-9D29-95CFF4F5A59D"
},
{
"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A69FB468-EAF3-4E67-95E7-DF92C281C1F1"
},
{
"criteria": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6A4F71A-4269-40FC-8F61-1D1301F2B728"
},
{
"criteria": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A502118-5B2B-47AE-82EC-1999BD841103"
},
{
"criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D551CAB1-4312-44AA-BDA8-A030817E153A"
},
{
"criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "174A6D2E-E42E-4C92-A194-C6A820CD7EF4"
}
],
"operator": "OR"
}
]
}
]