xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*

🗓️ 14 Feb 2022 13:06:09Reported by RedHatType

XStream SSRF via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* allows access to internal resources across Java runtimes.

Reporter	Title	Published	Views	Family All 116
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Protect Plus	10 Dec 202120:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	27 Apr 202223:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to a SSRF attack (CVE-2021-39152, CVE-2021-39150)	24 Jan 202314:54	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Xstream	24 Aug 202106:15	–	githubexploit
ATTACKERKB	CVE-2021-39150	23 Aug 202119:15	–	attackerkb

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-39150
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-39150
cve	www.cve.org/CVERecord

20 Aug 2026 00:20Current

7.4High risk

Vulners AI Score7.4

CVSS 26

CVSS 3.18.5

EPSS0.03437