GHSA-74cv-f58x-f9wf · Severity: medium · Ecosystem: maven — XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Conclusion & alert: CVE-2021-21343 is rated High Exploit Risk (60.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.62%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-10 | 0.69% | 0.62% | -0.06% |
| 2 | 2025-12-28 | 0.51% | 0.69% | +0.18% |
| 3 | 2025-12-27 | — | 0.51% | — |
Full EPSS history (43 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.3 | 3.1 | MEDIUM |
|
1.6 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-74cv-f58x-f9wf · Severity: medium · Ecosystem: maven — XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2021-21343 not yet assigned priority: Debian including 1 source packages (libxstream-java), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-21343 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-21343 |
suse
|
medium | CVE-2021-21343 severity moderate: SUSE including 245 source package names (5.0.0-beta1.2.122:xstream-1.4.16-3.8.1, 5.1.0.6.40:xstream-1.4.16-3.8.1, …), 278 product×package rows across 31 product lines (Container suse/manager/5.0/x86_64/server, Container suse/multi-linux-manager/5.1/x86_64/server, … (31 product lines)): Known Affected 231, Fixed 47. | https://www.suse.com/security/cve/CVE-2021-21343/ |
ubuntu
|
medium | CVE-2021-21343 medium priority: Ubuntu including 1 source packages (libxstream-java), 14 status rows across 14 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, trusty, upstream, xenial): released 14. | https://ubuntu.com/security/CVE-2021-21343 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| netapp | oncommand_insight | — | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| apache | activemq | < 5.15.14 | cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* |
| apache | activemq | 5.16.0 | cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:* |
| apache | activemq | 5.16.1 | cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:* |
| apache | jmeter | < 5.5 | cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:* |
| xstream | xstream | < 1.4.16 | cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| debian | debian_linux | 10.0 | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| debian | debian_linux | 11.0 | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| fedoraproject | fedora | 33 | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| fedoraproject | fedora | 34 | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| fedoraproject | fedora | 35 | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.10.0 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* |
| oracle | banking_enterprise_default_management | 2.12.0 | cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.4.0 | cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.7.1 | cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.9.0 | cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* |
| oracle | banking_platform | 2.12.0 | cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:* |
| oracle | banking_virtual_account_management | 14.2.0 | cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* |
| oracle | banking_virtual_account_management | 14.3.0 | cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* |
| oracle | banking_virtual_account_management | 14.5.0 | cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* |
| oracle | business_activity_monitoring | 11.1.1.9.0 | cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:* |
| oracle | business_activity_monitoring | 12.2.1.3.0 | cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | business_activity_monitoring | 12.2.1.4.0 | cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 12.0.0.3.0 | cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:* |
| oracle | communications_policy_management | 12.5.0 | cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.3.2 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.3.4 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.3.5 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.4.0 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.4.1 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* |
| oracle | retail_xstore_point_of_service | 16.0.6 | cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* |
| oracle | retail_xstore_point_of_service | 17.0.4 | cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* |
| oracle | retail_xstore_point_of_service | 18.0.3 | cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* |
| oracle | retail_xstore_point_of_service | 19.0.2 | cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* |
| oracle | webcenter_portal | 11.1.1.9.0 | cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* |
| oracle | webcenter_portal | 12.2.1.3.0 | cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | webcenter_portal | 12.2.1.4.0 | cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* |