| Vulnerability Name: | CVE-2021-21342 (CCN-198619) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2020-12-22 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2021-03-12 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2023-03-09 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) 4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C)
6.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2021-21342 Source: security-advisories@github.com Type: Release Notes, Third Party Advisory security-advisories@github.com Source: XF Type: UNKNOWN xstream-cve202121342-ssrf(198619) Source: security-advisories@github.com Type: Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mailing List, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mailing List, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mailing List, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mailing List, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mailing List, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mailing List, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Third Party Advisory security-advisories@github.com Source: CCN Type: IBM Security Bulletin 6450783 (Watson Discovery) IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream Source: CCN Type: IBM Security Bulletin 6454803 (Spectrum Control) Vulnerabilities in XStream, Java, OpenSSL, WebSphere Application Server Liberty and Node.js affect IBM Spectrum Control Source: CCN Type: IBM Security Bulletin 6466599 (Spectrum Protect Plus) Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus Source: CCN Type: IBM Security Bulletin 6468567 (InfoSphere Information Server) IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream Source: CCN Type: IBM Security Bulletin 6483059 (Tivoli Netcool Configuration Manager) XStream (Publicly disclosed vulnerability) Source: CCN Type: IBM Security Bulletin 6525260 (Spectrum Copy Data Management) Vulnerabilities in XStream affect IBM Spectrum Copy Data Management Source: CCN Type: IBM Security Bulletin 6570915 (Data Risk Manager) IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965) Source: CCN Type: IBM Security Bulletin 6607095 (Engineering Test Management) Multiple vulnerabilites affect IBM Engineering Test Management product due to XStream Source: security-advisories@github.com Type: Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Not Applicable security-advisories@github.com Source: security-advisories@github.com Type: Third Party Advisory security-advisories@github.com Source: CCN Type: WhiteSource Vulnerability Database CVE-2021-21342 Source: CCN Type: XStream GIT Repository CVE-2021-21342: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Source: security-advisories@github.com Type: Exploit, Third Party Advisory security-advisories@github.com Source: security-advisories@github.com Type: Mitigation, Third Party Advisory security-advisories@github.com | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||