● CVE — High
CVE-2021-39150
Vendordebian, fedoraproject, xstream, oracle, netappProductdebian linux, fedora, xstream, communications unified inventory management, snapmanager, webcenter portal, communications cloud native core automated test suite, retail xstore point of service, utilities framework, business activity monitoring, communications billing and revenue management elastic charging engine, communications cloud native core policy, commerce guided search, communications cloud native core binding support function, utilities testing acceleratorDiscoveredAug 23, 2021UpdatedOct 7, 2026
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18.