Strix
26.1K

CVE-2021-21348

HIGHCVSS 7.5/10EPSS 14.20%

Last modified

CVE-2021-21348 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. EPSS estimates a 14.20% chance of exploitation in the next 30 days.

Description

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
14.20%

96.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
NetappOncommand InsightAll versions
ApacheActivemq< 5.15.14
ApacheActivemq5.16.0
ApacheActivemq5.16.1
ApacheJmeter< 5.5
XstreamXstream< 1.4.16
DebianDebian Linux9.0
DebianDebian Linux10.0
DebianDebian Linux11.0
FedoraprojectFedora33
FedoraprojectFedora34
FedoraprojectFedora35
OracleBanking Enterprise Default Management2.10.0
OracleBanking Enterprise Default Management2.12.0
OracleBanking Platform2.4.0
OracleBanking Platform2.7.1
OracleBanking Platform2.9.0
OracleBanking Platform2.12.0
OracleBanking Virtual Account Management14.2.0
OracleBanking Virtual Account Management14.3.0
OracleBanking Virtual Account Management14.5.0
OracleBusiness Activity Monitoring11.1.1.9.0
OracleBusiness Activity Monitoring12.2.1.3.0
OracleBusiness Activity Monitoring12.2.1.4.0
OracleCommunications Billing And Revenue Management Elastic Charging Engine12.0.0.3.0
OracleCommunications Policy Management12.5.0
OracleCommunications Unified Inventory Management7.3.2
OracleCommunications Unified Inventory Management7.3.4
OracleCommunications Unified Inventory Management7.3.5
OracleCommunications Unified Inventory Management7.4.0
OracleCommunications Unified Inventory Management7.4.1
OracleMysql Server<= 8.0.27
OracleRetail Xstore Point Of Service16.0.6
OracleRetail Xstore Point Of Service17.0.4
OracleRetail Xstore Point Of Service18.0.3
OracleRetail Xstore Point Of Service19.0.2
OracleWebcenter Portal11.1.1.9.0
OracleWebcenter Portal12.2.1.3.0
OracleWebcenter Portal12.2.1.4.0

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2021-21348?
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
How severe is CVE-2021-21348?
CVE-2021-21348 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 14.20% probability of exploitation in the next 30 days.
How do I fix CVE-2021-21348?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-21348?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST