CVE-2021-21342

Public on 2021-03-23
Modified on 2024-02-12
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Severity
Important severity
Important
CVSS v3 Base Score
8.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core xstream 2023-04-27 ALAS2-2023-2030 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD CVSSv2 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
NVD CVSSv3 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N