SECUFOCUSNOW
Home›CVE index›CVE-2021-39144
CISA KEV · Known exploitedHigh

CVE-2021-39144

XStream

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS
8.5
EPSS
98.1%
99.9% percentile
CISA KEV
Listed
Published
2021.08.24
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability98.1%
Technical severityCVSS 8.5

Vulnerability overview

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Affected product and versions

Product
XStream
Affected versions
< 1.4.18, 9.0, 10.0, 11.0, 33, 34, 35, 12.2.1.4.0, 11.3.2, 11.3, 12.0, 1.9.0, 1.10.0, 1.14.0, 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2, 16.0.6
Fixed versions
1.4.18

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply updates per vendor instructions.

Due date: 2023.03.31
  1. 1
    Identify

    Confirm that XStream and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
CWE-306, CWE-502, CWE-94
KEV added
2023.03.10
Ransomware use
미확인
CVE-2021-39144 — XStream | SECUFOCUS NOW