CVE-2021-21350— XStream 代码问题漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2021-21350の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
XStream is vulnerable to an Arbitrary Code Execution attack
ソース: NVD (National Vulnerability Database)
脆弱性説明
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
危险类型文件的不加限制上传
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
XStream 代码问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。 XStream 1.4.16 之前版本存在代码问题漏洞，攻击者可利用该漏洞仅通过操作已处理的输入流来执行任意代码。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2021-21350の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2021-21350のインテリジェンス情報
请登录查看更多情报信息。
- https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
- https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrqx_refsource_CONFIRM
- https://www.oracle.com//security-alerts/cpujul2021.htmlx_refsource_MISC
- https://x-stream.github.io/CVE-2021-21350.htmlx_refsource_MISC
- http://x-stream.github.io/changes.html#1.4.16x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210430-0002/x_refsource_CONFIRM
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2021-21350
Same Patch Batch · x-stream · 2021-03-22 · 11 CVEs total
| CVE-2021-21341 | 7.5 HIGH | XStream can cause a Denial of Service |
| CVE-2021-21346 | 6.1 MEDIUM | XStream is vulnerable to an Arbitrary Code Execution attack |
| CVE-2021-21347 | 6.1 MEDIUM | XStream is vulnerable to an Arbitrary Code Execution attack |
| CVE-2021-21349 | 6.1 MEDIUM | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data s |
| CVE-2021-21345 | 5.8 MEDIUM | XStream is vulnerable to a Remote Command Execution attack |
| CVE-2021-21351 | 5.4 MEDIUM | XStream is vulnerable to an Arbitrary Code Execution attack |
| CVE-2021-21342 | 5.3 MEDIUM | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data s |
| CVE-2021-21343 | 5.3 MEDIUM | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling a |
| CVE-2021-21344 | 5.3 MEDIUM | XStream is vulnerable to an Arbitrary Code Execution attack |
| CVE-2021-21348 | 5.3 MEDIUM | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos |
IV. 関連脆弱性
同じ製品: xstream
- CVE-2024-47072
XStream is vulnerable to a Denial of Service attack due to s - CVE-2022-41966
XStream Denial of Service via stack overflow - CVE-2022-40151
Stack Buffer Overflow in xstream - CVE-2021-43859
Denial of Service by injecting highly recursive collections - CVE-2021-39150
A Server-Side Forgery Request vulnerability in XStream via P
同じベンダー: x-stream
- CVE-2024-47072
XStream is vulnerable to a Denial of Service attack due to s - CVE-2022-41966
XStream Denial of Service via stack overflow - CVE-2021-43859
Denial of Service by injecting highly recursive collections - CVE-2021-39150
A Server-Side Forgery Request vulnerability in XStream via P - CVE-2021-39152
A Server-Side Forgery Request vulnerability in XStream via H
同じ弱点: CWE-434
- CVE-2021-47943
TextPattern CMS 4.8.7 Remote Code Execution via File Upload - CVE-2021-47937
e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme - CVE-2026-41517
Emlog: Remote Code Execution via Malicious Plugin Upload - CVE-2026-6692
Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber - CVE-2026-41587
CI4MS: Unrestricted PHP File Upload via Theme Installation L
V. CVE-2021-21350へのコメント
まだコメントはありません