A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

🗓️ 25 Aug 2021 14:47:19Reported by GitHub Advisory DatabaseType

A Server-Side Forgery Request vulnerability in XStream allows unmarshalling to access data streams from arbitrary URLs

Reporter	Title	Published	Views	Family All 117
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Protect Plus	10 Dec 202120:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	27 Apr 202223:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to a SSRF attack (CVE-2021-39152, CVE-2021-39150)	24 Jan 202314:54	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Xstream	24 Aug 202106:15	–	githubexploit
ATTACKERKB	CVE-2021-39150	23 Aug 202119:15	–	attackerkb

Vulners

Node

Source	Link
github	www.github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-39150
x-stream	www.x-stream.github.io/CVE-2021-39150.html
security	www.security.netapp.com/advisory/ntap-20210923-0003/
lists	www.lists.debian.org/debian-lts-announce/2021/09/msg00017.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
debian	www.debian.org/security/2021/dsa-5004
oracle	www.oracle.com/security-alerts/cpujan2022.html

27 Jan 2023 05:02Current

8.3High risk

Vulners AI Score8.3

CVSS 26

CVSS 3.18.5

EPSS0.03437