CVE-2021-39150 A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

🗓️ 23 Aug 2021 18:20:15Reported by GitHub_MType

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling. XStream library may allow remote attacker to access internal data by manipulating input stream with Java runtime versions 14 to 8

Reporter	Title	Published	Views	Family All 117
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Protect Plus	10 Dec 202120:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	27 Apr 202223:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to a SSRF attack (CVE-2021-39152, CVE-2021-39150)	24 Jan 202314:54	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Xstream	24 Aug 202106:15	–	githubexploit
ATTACKERKB	CVE-2021-39150	23 Aug 202119:15	–	attackerkb

[
  {
    "product": "xstream",
    "vendor": "x-stream",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.4.18"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2021/09/msg00017.html
oracle	www.oracle.com/security-alerts/cpujul2022.html
oracle	www.oracle.com/security-alerts/cpujan2022.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
github	www.github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp
security	www.security.netapp.com/advisory/ntap-20210923-0003/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
oracle	www.oracle.com/security-alerts/cpuapr2022.html
x-stream	www.x-stream.github.io/CVE-2021-39150.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/

25 Jul 2022 16:33Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.5

EPSS0.03437