CVE-2021-39150

Server-Side Request Forgery (SSRF) in maven/com.thoughtworks.xstream/xstream

Identifier

CVE-2021-39150

Package Slug

maven/com.thoughtworks.xstream/xstream

Vulnerability

Server-Side Request Forgery (SSRF)

Description

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime to Users who followed the recommendation to setup XStream's security framework with an allow list limited to the minimal required types are not impacted.

Affected Versions

All versions before 1.4.18

Solution

Upgrade to version 1.4.18 or above.

Last Modified

2021-09-02

source