Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2021-29505

CVE information

Published

2 years ago

Last Modified

5 months ago

CVSSv2.0 Severity

Medium

CVSSv3.1 Severity

High

Impact Analysis

Share

Description

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17..

CVSSv2.0 Score

Severity
Medium
Base Score
6.5/10
Exploit Score
8/10
Access Vector
Network
Access Complexity
Low
Authentication Required
Single
Impact Score
6.4/10
Confidentiality Impact
Partial
Availability Impact
Partial
Integrity Impact
Partial

CVSSv3.1 Score

Severity
High
Base Score
8.8/10
Exploit Score
2.8/10
Access Vector
Network
Access Complexity
Low
Privileges Required
Low
Impact Score
5.9/10
Confidentiality Impact
High
Availability Impact
High
Integrity Impact
High
Scope
Unchanged
User Interaction
None

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
  Yes
- 1.4.17
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
  Yes
- -
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
  Yes
- -
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:communications_unified_inventory_management
  Yes
- -
cpe:2.3:a:oracle:communications_unified_inventory_management
  Yes
- -
cpe:2.3:a:oracle:communications_unified_inventory_management
  Yes
- -
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:
  Yes
- -
cpe:2.3:a:oracle:banking_credit_facilities_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_corporate_lending_process_managemen
  Yes
- -
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*
  Yes
- -
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*
  Yes
- -
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*
  Yes
- -
cpe:2.3:a:oracle:communications_unified_inventory_management
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_trade_finance_process_management:14
  Yes
- -
cpe:2.3:a:oracle:banking_credit_facilities_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_credit_facilities_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_corporate_lending_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_corporate_lending_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engin
  Yes
- -
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engin
  Yes
- -
cpe:2.3:a:oracle:communications_unified_inventory_management
  Yes
- -

References