{"schema":"threatline.record/2","record":{"id":"CVE-2021-39144","aliases":["GHSA-j9h8-phrw-h4fh"],"summary":"XStream Remote Code Execution Vulnerability","details":"XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.","categories":["Libraries & packages"],"product":"XStream","vendor":"XStream","ecosystem":"Maven","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-39144","source_modified_at":"2025-10-21T23:25:37.489Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"xstream","vendor":"x-stream","versions":[{"version":"< 1.4.18","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j9h8-phrw-h4fh","source_modified_at":"2026-07-08T06:27:23.933247432Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"com.thoughtworks.xstream:xstream","ecosystem":"Maven","purl":"pkg:maven/com.thoughtworks.xstream/xstream"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.10","1.4.10-java7","1.4.11","1.4.11-java7","1.4.11.1","1.4.12","1.4.12-java7","1.4.13","1.4.13-java7","1.4.14","1.4.14-java7","1.4.14-jdk7","1.4.15","1.4.16","1.4.17","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j9h8-phrw-h4fh","source_modified_at":"2026-07-08T06:27:23.933247432Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"com.thoughtworks.xstream:xstream","ecosystem":"Maven","purl":"pkg:maven/com.thoughtworks.xstream/xstream"},"version":"1.4.18"}],"cvss":8.5,"severity":"High","kev":{"listed":true,"date_added":"2023-03-10","due_date":"2023-03-31","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.98124,"percentile":0.99914,"score_date":"2026-10-23"},"published_at":"2021-08-23T00:00:00.000Z","modified_at":"2026-07-08T06:27:23.933247432Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2021-39144","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:25:37.489Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-j9h8-phrw-h4fh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-07-08T06:27:23.933247432Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2022-10-25"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39144.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-39144","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","OSV","Metasploit","Nuclei","EPSS"],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-2021-39144.html","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39144","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh","tags":["x_transferred"]},{"source":"CVE List","url":"https://x-stream.github.io/CVE-2021-39144.html","tags":["x_transferred"]},{"source":"CVE List","url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html","tags":["mailing-list","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/","tags":["vendor-advisory","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/","tags":["vendor-advisory","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/","tags":["vendor-advisory","x_transferred"]},{"source":"CVE List","url":"https://www.debian.org/security/2021/dsa-5004","tags":["vendor-advisory","x_transferred"]},{"source":"CVE List","url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred"]},{"source":"CVE List","url":"https://security.netapp.com/advisory/ntap-20210923-0003/","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39144","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2025-02-06T19:37:39.138340Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"VMware NSX Manager XStream unauthenticated RCE","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb","date":"2022-10-25","added":"2025-12-17","check":true},{"source":"Nuclei","kind":"Scanner template","name":"XStream 1.4.18 - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39144.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-07-08T06:27:23.933247432Z","content_hash":"743bf91321f4cd5aea6db1d3dbde4bb406e136f7c4ccbf1195a8c284f500f523"}}