The vulnerability of the Xstream Java library for converting objects to XML or JSON format arises from the lack of measures taken to eliminate special elements used in operating system commands. This allows attackers to delete any known files on the host.

🗓️ 23 Jun 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

XStream vulnerability allows file deletion by not neutralizing command elements in conversion.

Reporter	Title	Published	Views	Family All 101
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	27 Feb 202103:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Xstream, which is a required product for IBM Tivoli Network Configuration Manager (CVE-2020-26258, CVE-2020-26259)	24 Mar 202107:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	8 May 202101:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream, Apache HTTP, Jackson Databind, OpenSSL, and Node.js affect IBM Spectrum Control	18 Feb 202115:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in xstream-1.4.9.jar	29 Jan 202517:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus	28 Jun 202120:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Test Management is vulnerable to arbitrary data access due to XStream ( CVE-2020-26258, CVE-2020-26259 )	4 Jul 202211:30	–	ibm

Vulners

Node

xstream xstreamRange<1.4.15

OR

novell opensuse_leapMatch15.2

Source	Link
debian	www.debian.org/security/2021/dsa-4828
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-26259
x-stream	www.x-stream.github.io/CVE-2020-26259.html
suse	www.suse.com/security/cve/CVE-2020-26259/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
web	www.web.nvd.nist.gov/view/vuln/detail

21 Nov 2023 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 37.5

CVSS 28.5

EPSS0.82392

XStream vulnerability command elements file deletion object conversion