Sign In

CVE-2021-29505

📊 7.5 HIGH⚡ 90.8%🎯 2 exploits
📅 Published May 28, 2021
📋 Status: Modified

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

🎯 Affected Products & Systems

42 product configurations affected

Filter by type:
📱
xstream / xstream
Application
Vulnerable
Version: < 1.4.17
CPE:
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*
💻
debian / debian linux
Operating System
Vulnerable
Version: 9.0
CPE:
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
💻
debian / debian linux
Operating System
Vulnerable
Version: 10.0
CPE:
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
💻
debian / debian linux
Operating System
Vulnerable
Version: 11.0
CPE:
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
💻
fedoraproject / fedora
Operating System
Vulnerable
Version: 33
CPE:
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
💻
fedoraproject / fedora
Operating System
Vulnerable
Version: 34
CPE:
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
💻
fedoraproject / fedora
Operating System
Vulnerable
Version: 35
CPE:
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
📱
netapp / snapmanager
Application
Vulnerable
Version: All versions
Target SW: oracle
CPE:
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
📱
netapp / snapmanager
Application
Vulnerable
Version: All versions
Target SW: sap
CPE:
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
📱
Vulnerable
Version: 14.2
CPE:
cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.3
CPE:
cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.5
CPE:
cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.2.0
CPE:
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.3.0
CPE:
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.5.0
CPE:
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.2.0
CPE:
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.3.0
CPE:
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.5.0
CPE:
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.2.0
CPE:
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 14.5.0
CPE:
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 11.1.1.9.0
CPE:
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 12.2.1.3.0
CPE:
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 12.2.1.4.0
CPE:
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 11.3
CPE:
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*
📱
Vulnerable
Version: 12.0
CPE:
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 7.3.4
CPE:
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*
📱
Vulnerable
Version: 7.3.5
CPE:
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*
📱
Vulnerable
Version: 7.4.0
CPE:
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 7.4.1
CPE:
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
📱
Vulnerable
Version: 7.4.2
CPE:
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
📱
Vulnerable
Version: 12.4.0.0
CPE:
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 15.0.2
CPE:
cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*
📱
Vulnerable
Version: 16.0.2
CPE:
cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*
📱
Vulnerable
Version: 16.0.6
CPE:
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
📱
Vulnerable
Version: 17.0.4
CPE:
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
📱
Vulnerable
Version: 18.0.3
CPE:
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
📱
Vulnerable
Version: 19.0.2
CPE:
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
📱
Vulnerable
Version: 20.0.1
CPE:
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*
📱
Vulnerable
Version: 12.2.1.3.0
CPE:
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
📱
Vulnerable
Version: 12.2.1.4.0
CPE:
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
📱
oracle / webcenter sites
Application
Vulnerable
Version: 12.2.1.3.0
CPE:
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
📱
oracle / webcenter sites
Application
Vulnerable
Version: 12.2.1.4.0
CPE:
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
42 products•scroll for more
Metrics
7.5 HIGHCVSS v3.1[email protected]
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector:
NETWORK
Complexity:
HIGH
Privileges:
LOW
User Interaction:
NONE
Confidentiality:
HIGH
Integrity:
HIGH
Availability:
HIGH
Scope:
UNCHANGED

🔍 Technical Details

Analysis Status
Modified
CVSS Details
7.5 (HIGH)v3.1
Source: [email protected]
EPSS Details
90.8% (Critical)99.6th percentile
Last updated: Nov 1, 2025
Exploitation probability within 30 days
Published Date
May 28, 2021 (4 years ago)
Last Modified
May 30, 2025 (5 months ago)
Security Weaknesses3

Available exploits (2)

🔐 Sign-in Required

Sign in to view exploits and proof-of-concept code.

Sign InCreate Account
References21