XStream 操作系统命令注入漏洞

🗓️ 22 Mar 2021 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 1 Views

XStream 命令注入漏洞可通过输入流注入对象实现本地命令执行。

Reporter	Title	Published	Views	Family All 132
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Engineering Test Management product due to XStream	26 Jul 202206:38	–	ibm
IBM Security Bulletins	Security Bulletin: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating	13 Apr 202121:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream, Java, OpenSSL, WebSphere Application Server Liberty and Node.js affect IBM Spectrum Control	20 May 202108:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream and Apache MINA might affect IBM Storage Defender Copy Data Management.	16 May 202519:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus	28 Jun 202120:25	–	ibm
IBM Security Bulletins	Security Bulletin: XStream (Publicly disclosed vulnerability)	23 Aug 202105:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	8 Jul 202119:08	–	ibm

Source	Link
lists	www.lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
x-stream	www.x-stream.github.io/security.html
oracle	www.oracle.com/security-alerts/cpujan2022.html
lists	www.lists.debian.org/debian-lts-announce/2021/04/msg00002.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
x-stream	www.x-stream.github.io/changes.html
security	www.security.netapp.com/advisory/ntap-20210430-0002/
x-stream	www.x-stream.github.io/CVE-2021-21345.html
lists	www.lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
github	www.github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4

24 May 2026 00:00Current

8.9High risk

Vulners AI Score8.9

CVSS 26.5

CVSS 3.15.8 - 9.9

EPSS0.86558

XStream command injection input stream object injection local command execution Java serialization