CVE-2021-39152 is a Server-Side Request Forgery (SSRF) vulnerability in XStream, a Java library for XML serialization, affecting versions prior to 1.4.18. This flaw allows a remote attacker to request data from internal resources by manipulating the input stream, specifically impacting Java runtime versions 8 through 14. With a CVSS score of 8.5 (High), the attack requires low privileges but has high impact on confidentiality, integrity, and availability, with high attack complexity. While not listed on CISA's KEV catalog and lacking public exploits on Metasploit or ExploitDB, Nuclei templates exist for detection, and there is no significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.4.18CPE matchmatch criteria | cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aug 25, 2021xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData
Aug 22, 2021