WaratekVRT Sign in

CVE-2016-3674 XStream

Affected softwareXStream
Severity7.5 High CVSS 3.1 2 scores
Fixed in1.4.9
WeaknessInformation exposure (CWE-200)
Published17 May 2016
Updated8 Oct 2026

Description

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 10 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 8.2% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full XXE
  • Action available security rule
  • Review automated Inferred
  • Record active
Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR xxe security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's description identifies a XXE vulnerability. Matched by description (CWE-200 was assigned, but does not settle the class on its own).

How to mitigate CVE-2016-3674

Upgrade XStream to 1.4.9 or later. Until you can, Waratek RASP blocks exploitation with its XXE rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle Utilities Applications / UI, Batch and XAI (Xstream) (2.2.0.0.0, 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0, 4.3.0.3.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Utilities Applications UI, Batch and XAI (Xstream) 2.2.0.0.0, 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0, 4.3.0.3.0 2.2.0.0.0 · 4.1.0.1.0 · 4.1.0.2.0 · 4.2.0.1.0 · 4.2.0.2.0 · 4.2.0.3.0 · 4.3.0.1.0 · 4.3.0.2.0 · 4.3.0.3.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.thoughtworks.xstream:xstream 0 1.4.9 unbounded

Products and versions

5 products, 6 version entries
SourceVendorProductSchemeAffected versions
osv com.thoughtworks.xstream xstream generic ＜ 1.4.9
nvd debian debian linux generic 8.0
nvd fedoraproject fedora generic 22 · 23
nvd redhat jboss middleware generic 1
nvd xstream xstream generic ＜ 1.4.9

References

URLTags
https://github.com/x-stream/xstream/issues/25 WEB
https://github.com/x-stream/xstream PACKAGE
https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385 WEB
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html WEB
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html WEB
http://rhn.redhat.com/errata/RHSA-2016-2822.html WEB
http://rhn.redhat.com/errata/RHSA-2016-2823.html WEB
http://www.debian.org/security/2016/dsa-3575 WEB
http://www.openwall.com/lists/oss-security/2016/03/25/8 WEB
http://www.openwall.com/lists/oss-security/2016/03/28/1 WEB

Timeline
Published2016-05-17By the CVE Program.
NVD record modified2026-10-08NVD's own last-modified date for this record.