xstream-1.4.5.jar: 35 vulnerabilities (highest severity is: 9.9)

[mend-for-github-com]

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (xstream version)	Remediation Possible**
CVE-2021-21345	Critical	9.9	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-21344	Critical	9.8	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2013-7285	Critical	9.8	xstream-1.4.5.jar	Direct	1.4.10-java7	✅
CVE-2021-21350	Critical	9.8	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-21347	Critical	9.8	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-21346	Critical	9.8	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-21342	Critical	9.1	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-21351	Critical	9.1	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-39139	High	8.8	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2020-26217	High	8.8	xstream-1.4.5.jar	Direct	1.4.13-java7	✅
CVE-2021-29505	High	8.8	xstream-1.4.5.jar	Direct	1.4.17	✅
CVE-2021-21349	High	8.6	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-39150	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39152	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39151	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39154	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39153	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39141	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39145	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39144	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39147	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39146	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39149	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2021-39148	High	8.5	xstream-1.4.5.jar	Direct	1.4.18	✅
CVE-2020-26258	High	7.7	xstream-1.4.5.jar	Direct	1.4.14-jdk7	✅
CVE-2021-21343	High	7.5	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2021-21341	High	7.5	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2022-41966	High	7.5	xstream-1.4.5.jar	Direct	1.4.12-java7	✅
CVE-2017-7957	High	7.5	xstream-1.4.5.jar	Direct	1.4.10	✅
CVE-2016-3674	High	7.5	xstream-1.4.5.jar	Direct	1.4.9	✅
CVE-2021-43859	High	7.5	xstream-1.4.5.jar	Direct	1.4.6	✅
CVE-2021-21348	High	7.5	xstream-1.4.5.jar	Direct	1.4.16	✅
CVE-2022-40151	High	7.5	xstream-1.4.5.jar	Direct	1.4.20	✅
CVE-2020-26259	Medium	6.8	xstream-1.4.5.jar	Direct	1.4.14-jdk7	✅
CVE-2021-39140	Medium	6.3	xstream-1.4.5.jar	Direct	1.4.18	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (24 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2021-21345

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21345

CVSS 3 Score Details (9.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hwpc-8xqv-jvj4

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21344

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21344

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-59jw-jqf4-3wq3

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2013-7285

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Publish Date: 2019-05-15

URL: CVE-2013-7285

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7285

Release Date: 2019-05-15

Fix Resolution: 1.4.10-java7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21350

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21350

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43gc-mjxg-gvrq

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21347

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21347

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qpfq-ph7r-qv6f

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21346

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21346

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4hrm-m67v-5cxr

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21342

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21342

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hvv8-336g-rx3m

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21351

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21351

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hrcp-8f3q-4w2c

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39139

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39139

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-64xx-cq4q-mf44

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-26217

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Publish Date: 2020-11-16

URL: CVE-2020-26217

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mw36-7c6c-q4q2

Release Date: 2020-11-16

Fix Resolution: 1.4.13-java7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-29505

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Publish Date: 2021-05-28

URL: CVE-2021-29505

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7chv-rrw6-w6fc

Release Date: 2021-05-28

Fix Resolution: 1.4.17

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21349

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Publish Date: 2021-03-23

URL: CVE-2021-21349

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f6hm-88x3-mfjv

Release Date: 2021-03-23

Fix Resolution: 1.4.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39150

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18.

Publish Date: 2021-08-23

URL: CVE-2021-39150

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hph2-m3g5-xxv4

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39152

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18.

Publish Date: 2021-08-23

URL: CVE-2021-39152

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xw4p-crpj-vjx2

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39151

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39151

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hph2-m3g5-xxv4

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39154

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39154

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6w62-hx7r-mw68

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39153

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39153

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39153

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39141

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39141

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g5w6-mrj7-75h2

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39145

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39145

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8jrj-525p-826v

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39144

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39144

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j9h8-phrw-h4fh

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39147

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39147

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h7v4-7xg3-hxcc

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39146

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39146

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8pq-r894-fm8f

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39149

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39149

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3ccq-5vw3-2p6x

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-39148

Vulnerable Library - xstream-1.4.5.jar

XStream is a serialization library from Java objects to XML and back.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.5/xstream-1.4.5.jar

Dependency Hierarchy:

• ❌ xstream-1.4.5.jar (Vulnerable Library)

Found in HEAD commit: 6cb7371a4a786747d7db4f425a1e591b13dc7cdc

Found in base branch: main

Vulnerability Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Publish Date: 2021-08-23

URL: CVE-2021-39148

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qrx8-8545-4wg2

Release Date: 2021-08-23

Fix Resolution: 1.4.18

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.