Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21327 State: PUBLISHED Published: 2021-03-08T17:00:17 Last Updated: 2024-08-03T18:09:15.583Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-862 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this vulnerability affects integrity of the GLPI core platf
, or to start a “POP chain”. As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. This is fixed in version 9.5.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/releases/tag/9.5.4 - https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp - http://packetstormsecurity.com/files/161680/GLPI-9.5.3-Unsafe-Reflection.html
CVE ID: CVE-2021-21328 State: PUBLISHED Published: 2021-02-26T01:45:23 Last Updated: 2024-08-03T18:09:15.396Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: vapor Products: vapor Problem Types: CWE-400 Description: Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error path
entually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc - https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23 - https://github.com/vapor/vapor/releases/tag/4.40.1 - https://vapor.codes/
CVE ID: CVE-2021-21329 State: PUBLISHED Published: 2021-03-08T17:15:16 Last Updated: 2024-08-03T18:09:15.191Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: ractf Products: core Problem Types: CWE-287 Description: RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85 - https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#
security/advisories/GHSA-fw57-f7mq-9q85 - https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#diff-60c444c47c061306f2dff5bf97c07810f40f949a8e94ecbb609b6b29364c8642R130-R152 - https://github.com/ractf/core/commit/cebb67bd16a8296121201805332365ffccb29638
CVE ID: CVE-2021-21330 State: PUBLISHED Published: 2021-02-26T02:15:15 Last Updated: 2024-08-03T18:09:15.080Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: aio-libs Products: aiohttp Problem Types: CWE-601 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "
th_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg - https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b - https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25 - https://pypi.org/project/aiohttp/ - https://www.debian.org/security/2021/dsa-4864 - https://lis
GES.rst#374-2021-02-25 - https://pypi.org/project/aiohttp/ - https://www.debian.org/security/2021/dsa-4864 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L/ - https://security.gentoo.org/glsa/202208-19
CVE ID: CVE-2021-21331 State: PUBLISHED Published: 2021-03-03T23:00:19 Last Updated: 2024-08-03T18:09:15.420Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: DataDog Products: datadog-api-client-java Problem Types: CWE-379, CWE-378 Description: The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version
n. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system. Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. This issue has been patched in v
likelihood is low. The unused code has been removed, effectively mitigating this issue. This issue has been patched in version 1.0.0-beta.9. As a workaround one may specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DataDog/datadog-api-client-java/security/advisories/GHSA-2cxf-6567-7pp6 - https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9
CVE ID: CVE-2021-21332 State: PUBLISHED Published: 2021-03-26T19:55:17 Last Updated: 2024-08-03T18:09:15.157Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-79 Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulne
figuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899 - https://github.com/matrix-org/synapse/releases/tag/v1.27.0 - https://github.com/matrix-org/synapse/pull/9200 - https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RF
f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
CVE ID: CVE-2021-21333 State: PUBLISHED Published: 2021-03-26T20:00:19 Last Updated: 2024-08-03T18:09:15.578Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-74 Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. Th
e case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/releases/tag/v1.27.0 - https://github.com/matrix-org/synapse/pull/9200 - https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df - https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess
ries/GHSA-c5f8-35qr-q4fm - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
CVE ID: CVE-2021-21334 State: PUBLISHED Published: 2021-03-10T21:30:18 Last Updated: 2024-08-03T18:09:15.415Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: containerd Products: containerd Problem Types: CWE-668 Description: In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, th
including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in conta
pid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4 - https://github.com/containerd/containerd/releases/tag/v1.4.4 - https://github.com/containerd/containerd/releases/tag/v1.3.10 - https://github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD/ - https://security.gentoo.org/glsa/202105-33
CVE ID: CVE-2021-21335 State: PUBLISHED Published: 2021-03-08T20:20:19 Last Updated: 2024-08-03T18:09:15.422Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: stnoonan Products: spnego-http-auth-nginx-module Problem Types: CWE-287 Description: In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication. Additional Analyst Notes: - CVE Program Co
ttp-auth-nginx-module. As a workaround, one may disable basic authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stnoonan/spnego-http-auth-nginx-module/security/advisories/GHSA-ww8q-72rx-hc54 - https://github.com/stnoonan/spnego-http-auth-nginx-module/commit/a06f9efca373e25328b1c53639a48decd0854570 - https://github.com/stnoonan/spnego-http-auth-nginx-module/releases/tag/v1.1.1
CVE ID: CVE-2021-21336 State: PUBLISHED Published: 2021-03-08T20:40:17 Last Updated: 2024-08-03T18:09:15.333Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: zopefoundation Products: Products.PluggableAuthService Problem Types: CWE-200 Description: Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService,
plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p - https://pypi.org/project/Products.PluggableAuthService/ - https://github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bb - http://www.openwall.com/lists/oss-security/2021/05/21/1 - http://www.openwal
/2dad81128250cb2e5d950cddc9d3c0314a80b4bb - http://www.openwall.com/lists/oss-security/2021/05/21/1 - http://www.openwall.com/lists/oss-security/2021/05/22/1
CVE ID: CVE-2021-21337 State: PUBLISHED Published: 2021-03-08T21:10:20 Last Updated: 2024-08-03T18:09:15.746Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: zopefoundation Products: Products.PluggableAuthService Problem Types: CWE-601 Description: Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthServi
nt website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1". Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/Products.PluggableAuthService/ - https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr - https://github.com/zopefoundation/Products.PluggableAuthService/commit/7eead067898852ebd3e0f143bc51295928528dfa - http://packetstormsecurity.com/files/162911/Products.PluggableAuthServ
commit/7eead067898852ebd3e0f143bc51295928528dfa - http://packetstormsecurity.com/files/162911/Products.PluggableAuthService-2.6.0-Open-Redirect.html
CVE ID: CVE-2021-21338 State: PUBLISHED Published: 2021-03-23T01:45:14 Last Updated: 2024-08-03T18:09:15.687Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-601 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.
required in order to exploit this vulnerability. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4jhw-2p6j-5wmp - https://packagist.org/packages/typo3/cms-core - https://typo3.org/security/advisory/typo3-core-sa-2021-001
CVE ID: CVE-2021-21339 State: PUBLISHED Published: 2021-03-23T01:50:40 Last Updated: 2024-08-03T18:09:15.911Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-312 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in vers
tion with a chained attack - like for instance SQL injection in any other component of the system. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://packagist.org/packages/typo3/cms-core - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-qx3w-4864-94ch - https://typo3.org/security/advisory/typo3-core-sa-2021-006
CVE ID: CVE-2021-21340 State: PUBLISHED Published: 2021-03-23T01:50:34 Last Updated: 2024-08-03T18:09:15.910Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1 . Additional Analyst Notes: - CVE Program Container: References: - https://github.c
is fixed in versions 10.4.14, 11.1.1 . Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-fjh3-g8gq-9q92 - https://packagist.org/packages/typo3/cms-backend - https://typo3.org/security/advisory/typo3-core-sa-2021-007
CVE ID: CVE-2021-21341 State: PUBLISHED Published: 2021-03-22T23:40:44 Last Updated: 2024-08-03T18:09:15.857Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-400, CWE-502 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framew
ating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh - https://x-stream.github.io/CVE-2021-21341.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac
41.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html - https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E - https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E - https://security.netapp.com/advisory/ntap-20210430-0002/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDH
DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-21342 State: PUBLISHED Published: 2021-03-22T23:40:39 Last Updated: 2024-08-03T18:09:15.862Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: x-stream Products: xstream Problem Types: CWE-502, CWE-918 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side for
n. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Additional Analyst Notes: - CVE Program Container: References: - https://x-stream.github.io/security.html#workaround - http://x-stream.github.io/changes.html#1.4.16 - https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m - https://x-stream.github.io/CVE-2021-21342.html - https://l