Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2021-21346 medium CVSS 6.1

Unrestricted File Upload in com.thoughtworks.xstream:xstream (CVE-2021-21346)

Summary

Vulnerability in com.thoughtworks.xstream:xstream (CVE-2021-21346). Data can be tampered with by attackers. Mitigation: upgrade to 1.4.16 or later.

Original description

The description as published by the source.

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-21346 has been found in com.thoughtworks.xstream:xstream.
Data can be tampered with by attackers. CVSS score: 6.1/10.
What to do: upgrade com.thoughtworks.xstream:xstream to 1.4.16 or later.
If unsure, ask your IT team or search "com.thoughtworks.xstream:xstream CVE-2021-21346" on the vendor's site.

CVE-2021-21346 (com.thoughtworks.xstream:xstream) — CWE-434 / CVSS v3 6.1
Attack vector: remote (network-reachable) / unauthenticated
Patched: 1.4.16 — apply immediately
Workaround: See workarounds for the different versions covering all CVEs.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-434) exists in com.thoughtworks.xstream:xstream.

📍 Affected scope

Check the vendor advisory for the affected versions of com.thoughtworks.xstream:xstream.

🔥 Severity

Severity: Medium (CVSS 6.1/10). Data can be tampered with by attackers.

🔧 How to fix

Update to 1.4.16.

🛡️ Workaround

Workaround: See workarounds for the different versions covering all CVEs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで com.thoughtworks.xstream:xstream を使っているサービスとバージョンを洗い出す。

  2. 2
    Apply temporary workaround mitigate 
    See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

    パッチが適用されるまでの応急処置として、See workarounds for the different versions covering all CVEs. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade com.thoughtworks.xstream:xstream to 1.4.16

    ステージング環境で 1.4.16 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Maven com.thoughtworks.xstream:xstream
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.16"}]}]
Bitnami activemq
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.15.14"}]},{"type":"SEMVER","events":[{"introduced":"5.16.0"},{"last_affected":"5.16.0"},{"introduced":"5.16.1"},{"last_affected":"5.16.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details