CVE-2021-21346

🗓️ 22 Mar 2021 23:40:20Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 410 Views

XStream Java library vulnerability allows remote code execution by manipulating input stream

Reporter	Title	Published	Views	Family All 127
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Engineering Test Management product due to XStream	26 Jul 202206:38	–	ibm
IBM Security Bulletins	Security Bulletin: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating	13 Apr 202121:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream, Java, OpenSSL, WebSphere Application Server Liberty and Node.js affect IBM Spectrum Control	20 May 202108:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus	28 Jun 202120:25	–	ibm
IBM Security Bulletins	Security Bulletin: XStream (Publicly disclosed vulnerability)	23 Aug 202105:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	8 Jul 202119:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	14 May 202101:38	–	ibm

NVD

Vulners

Node

netapp oncommand_insightMatch-

Node

apache activemqRange<5.15.14

apache activemqMatch5.16.0

apache activemqMatch5.16.1

apache jmeterRange<5.5

Node

xstream xstreamRange<1.4.16

Node

debian debian_linuxMatch9.0

debian debian_linuxMatch10.0

debian debian_linuxMatch11.0

Node

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

Node

oracle banking_enterprise_default_managementMatch2.10.0

oracle banking_enterprise_default_managementMatch2.12.0

oracle banking_platformMatch2.4.0

oracle banking_platformMatch2.7.1

oracle banking_platformMatch2.9.0

oracle banking_platformMatch2.12.0

oracle banking_virtual_account_managementMatch14.2.0

oracle banking_virtual_account_managementMatch14.3.0

oracle banking_virtual_account_managementMatch14.5.0

oracle bi_publisherMatch5.5.0.0.0

oracle bi_publisherMatch12.2.1.3.0

oracle bi_publisherMatch12.2.1.4.0

oracle business_activity_monitoringMatch11.1.1.9.0

oracle business_activity_monitoringMatch12.2.1.3.0

oracle business_activity_monitoringMatch12.2.1.4.0

oracle communications_billing_and_revenue_management_elastic_charging_engineMatch12.0.0.3.0

oracle communications_policy_managementMatch12.5.0

oracle communications_unified_inventory_managementMatch7.3.2

oracle communications_unified_inventory_managementMatch7.3.4

oracle communications_unified_inventory_managementMatch7.3.5

oracle communications_unified_inventory_managementMatch7.4.0

oracle communications_unified_inventory_managementMatch7.4.1

oracle retail_xstore_point_of_serviceMatch16.0.6

oracle retail_xstore_point_of_serviceMatch17.0.4

oracle retail_xstore_point_of_serviceMatch18.0.3

oracle retail_xstore_point_of_serviceMatch19.0.2

oracle webcenter_portalMatch11.1.1.9.0

oracle webcenter_portalMatch12.2.1.3.0

oracle webcenter_portalMatch12.2.1.4.0

[
  {
    "product": "xstream",
    "vendor": "x-stream",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.4.16"
      }
    ]
  }
]

Source	Link
x-stream	www.x-stream.github.io/CVE-2021-21346.html
x-stream	www.x-stream.github.io/security.html
oracle	www.oracle.com//security-alerts/cpujul2021.html
github	www.github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr
lists	www.lists.debian.org/debian-lts-announce/2021/04/msg00002.html
lists	www.lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
x-stream	www.x-stream.github.io/changes.html
lists	www.lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
debian	www.debian.org/security/2021/dsa-5004

23 May 2025 17:41Current

8.3High risk

Vulners AI Score8.3

CVSS 27.5

CVSS 3.16.1 - 9.8

EPSS0.03665