CVE-2021-39144

Description from NVD

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Information Acquisition Date:2023-03-31T16:40Z
CVSS 2.0: 6.0 MEDIUM CVSS 3.x: 8.5 HIGH

▼ CVSS3 Vec CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

▼ CVSS2 Vec AV:N/AC:M/Au:S/C:P/I:P/A:P

NVD References

 https://x-stream.github.io/CVE-2021-39144.html
     source:MISC
     tags:Exploit    Vendor Advisory    
 https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
     source:CONFIRM
     tags:Third Party Advisory    
 https://security.netapp.com/advisory/ntap-20210923-0003/
     source:CONFIRM
     tags:Third Party Advisory    
 [debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update
     source:MLIST
     tags:Mailing List    Third Party Advisory    
 FEDORA-2021-fbad11014a
     source:FEDORA
     tags:Mailing List    Third Party Advisory    
 FEDORA-2021-d894ca87dc
     source:FEDORA
     tags:Mailing List    Third Party Advisory    
 FEDORA-2021-5e376c0ed9
     source:FEDORA
     tags:Mailing List    Third Party Advisory    
 DSA-5004
     source:DEBIAN
     tags:Third Party Advisory    
 https://www.oracle.com/security-alerts/cpujan2022.html
     source:MISC
     tags:Patch    Third Party Advisory    
 https://www.oracle.com/security-alerts/cpuapr2022.html
     source:MISC
     tags:Patch    Third Party Advisory    
 N/A
     source:N/A
     tags:Patch    Third Party Advisory    
 http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html
     source:MISC
     tags:Exploit    Third Party Advisory    VDB Entry    

This vulnerability may involve a PoC.

Refer to Information on External Sites

CVE InfomationExploits or more Infomation
mitreEXPLOIT DATABASE
NVD0day.today
vulmon.comgithub
CVE DetailsTwitter
JVN ENG JPN
Reconshell

Software Tag: VMware(14 tweets) iOS(1 tweets)



List of frequently cited URLs

URLNum of Times Referred to
https://cvetrends.com48
https://securityaffairs.co/wordpress/137912/security/vmware...19
https://lists.astaro.com/ASGV9-IPS-rules.html#012
https://www.cisa.gov/known-exploited-vulnerabilities-catalog9
https://thehackernews.com/2022/10/vmware-releases-patch-for...9
https://go.dhs.gov/Z3Q6
https://opsmtrs.com/2ZFbaTl6
https://securityonline.info/hackers-are-actively-exploiting...4
https://www.zerodayinitiative.com/blog/2022/10/19/cve-2022-...4
https://github.com/zwjjustdoit/Xstream-1.4.173
https://twitter.com/ptracesecurity/status/14301909790726348863
http://mi6rogue.com/blog3
https://www.vmware.com/security/advisories/VMSA-2022-0027.html3
https://my.socprime.com/pricing3

▼ Show Information from Twitter(277)


List of frequently cited URLs

URLNum of Times Referred to
cvetrends.com48
securityaffairs.co19
lists.astaro.com12
www.cisa.gov9
thehackernews.com9
go.dhs.gov6
opsmtrs.com6
securityonline.info4
www.zerodayinitiative.com4
github.com3
twitter.com3
mi6rogue.com3
www.vmware.com3
my.socprime.com3

▼ Show Information from Twitter(277)


GitHub Search Results: Up to 10
NameURL
zwjjustdoit/Xstream-1.4.17 https://github.com/zwjjustdoit/Xstream-1.4.17

GitHub Search Results: Up to 10
NameURL
zwjjustdoit/Xstream-1.4.17 github.com

2023/03/31 Score : 0
Added Har-sia Database : 2021/08/24
Last Modified : 2023/03/31
Highest Scored Date : 2023/03/16
Highest Score : 108