Cyber Resilience

CVE-2021-39150

HighPublic PoCRCE

Published: 23 August 2021

Published
23 August 2021
Modified
23 May 2025
KEV Added
Patch
CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0214 84.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-39150 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Oracle Utilities Framework. Its CVSS base score is 8.5 (High).

Operationally, ranked in the top 15.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input…

more

stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xstream
xstream
≤ 1.4.18
fedoraproject
fedora
33, 34, 35
debian
debian linux
10.0, 11.0, 9.0
netapp
snapmanager
all versions
oracle
business activity monitoring
12.2.1.4.0
oracle
commerce guided search
11.3.2
oracle
communications billing and revenue management elastic charging engine
11.3, 12.0
oracle
communications cloud native core automated test suite
1.9.0
oracle
communications cloud native core binding support function
1.10.0
oracle
communications cloud native core policy
1.14.0
+5 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-918 CWE-502

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

addresses: CWE-918 CWE-502

Validates server-side URLs and resource references to block SSRF attempts.

addresses: CWE-502

Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.

addresses: CWE-502

Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

addresses: CWE-502

Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

addresses: CWE-502

Integrity verification of serialized information can detect tampering before deserialization occurs.

References