Is CVE-2021-21345 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 73%.

What products does CVE-2021-21345 affect?

Tracked products affected include ActiveMQ, PeopleSoft Enterprise PeopleTools. Check the version you run to see whether it is affected.

How do I fix CVE-2021-21345?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

← All products

CVE-2021-21345

Q: What is CVE-2021-21345?

CVE-2021-21345 is a medium-severity software vulnerability (Code injection) with a CVSS score of 5.8. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulatin

MEDIUM severity · CVSS 5.8 · Code injection

5.8CVSS MEDIUM

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredLow

User interactionRequired

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)73%

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

Affected products we track (2)

ActiveMQ PeopleSoft Enterprise PeopleTools

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2021-21345

Summary

Impact & exploitability

Affected products we track (2)

Recommendation

Additional information