All vulnerabilities
CVE-2021-39144GHSA-j9h8-phrw-h4fh

XStream Remote Code Execution Vulnerability

XStream XStreamMavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.5High
ExploitationExploited in the wildAdded to KEV 10 Mar 2023CISA KEV
Exploit odds (EPSS)98.1%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.18Fixed versionOSV
Federal deadline31 Mar 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 1.4.18com.thoughtworks.xstream:xstream, MavenOSV<dependency><groupId>com.thoughtworks.xstream</groupId><artifactId>xstream</artifactId><version>1.4.18</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 23 Aug 2021, 00:00 UTCPublishedCVE List
  2. 25 Oct 2022Exploit code publicMetasploit
  3. 10 Mar 2023Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleVMware NSX Manager XStream unauthenticated RCE 25 Oct 2022Metasploit
  • Scanner templateXStream 1.4.18 - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.

Text from CVE List

Affected versions 44

  • xstreamaffected: < 1.4.18CVE List
  • com.thoughtworks.xstream:xstream, Mavenfrom first release, fixed in 1.4.18OSV
  • com.thoughtworks.xstream:xstream, Maven0.1OSV
  • com.thoughtworks.xstream:xstream, Maven0.2OSV
  • com.thoughtworks.xstream:xstream, Maven0.3OSV
  • com.thoughtworks.xstream:xstream, Maven0.5OSV
  • com.thoughtworks.xstream:xstream, Maven0.6OSV
  • com.thoughtworks.xstream:xstream, Maven1.0OSV
  • com.thoughtworks.xstream:xstream, Maven1.0.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.0.2OSV
  • com.thoughtworks.xstream:xstream, Maven1.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.1.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.1.2OSV
  • com.thoughtworks.xstream:xstream, Maven1.1.3OSV
  • com.thoughtworks.xstream:xstream, Maven1.2OSV
  • com.thoughtworks.xstream:xstream, Maven1.2.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.2.2OSV
  • com.thoughtworks.xstream:xstream, Maven1.3OSV
  • com.thoughtworks.xstream:xstream, Maven1.3.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.4OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.10OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.10-java7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.11OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.11-java7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.11.1OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.12OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.12-java7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.13OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.13-java7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.14OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.14-java7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.14-jdk7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.15OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.16OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.17OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.2OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.3OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.4OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.5OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.6OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.7OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.8OSV
  • com.thoughtworks.xstream:xstream, Maven1.4.9OSV

References 14