VRT
391,810 CVEs tracked ·
15,472 in RASP scope ·
data as of 45 minutes ago
VRT
391,810 CVEs tracked ·
15,472 in RASP scope ·
data as of 45 minutes ago
CVE-2021-21350XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-434 · Unrestricted file uploadCWE-502 · Deserialization of untrusted data
No public exploit
Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 5 years.
CVSS E:U
A Waratek agent blocks this today.
Applicable rule: A researcher classified this CVE as MITIGATED-BY-SECURE-RULE, protected by the ARMR XXE rule.
| Decided by | manual-classification : A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher classified this CVE as MITIGATED-BY-SECURE-RULE, protected by the ARMR XXE rule. |
Written by a Waratek engineer reviewing this CVE. A written classification sets the status directly, ahead of every automated scope rule except a withdrawal.
Rule Name: XXE rule
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
VRT selects the newest version's highest entry and
publishes it as cvssScore, newest rather than largest because scores are not comparable
across versions, and highest rather than first because the first entry is frequently a CNA placeholder
scoring 0.0 over NVD's own analysis.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
security-advisories@github.com | Secondary | |
| CVSS 2.0 | 7.5 | no band published | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
| Package Coordinate | Introduced | Fixed | Last affected |
|---|---|---|---|
com.thoughtworks.xstream:xstream |
0 | 1.4.16 |
unbounded |
| Source | Vendor | Product | Scheme | Affected Versions |
|---|---|---|---|---|
| nvd | apache | activemq | generic | ＜ 5.15.14 · 5.16.0 · 5.16.1 |
| nvd | apache | jmeter | generic | ＜ 5.5 |
| osv | com.thoughtworks.xstream | xstream | generic | ＜ 1.4.16 |
| nvd | debian | debian linux | generic | 9.0 · 10.0 · 11.0 |
| nvd | fedoraproject | fedora | generic | 33 · 34 · 35 |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | oracle | banking enterprise default management | generic | 2.10.0 · 2.12.0 |
| nvd | oracle | banking platform | generic | 2.4.0 · 2.7.1 · 2.9.0 · 2.12.0 |
| nvd | oracle | banking virtual account management | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | business activity monitoring | generic | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | communications billing and revenue management elastic charging engine | generic | 12.0.0.3.0 |
| nvd | oracle | communications policy management | generic | 12.5.0 |
| nvd | oracle | communications unified inventory management | generic | 7.3.2 · 7.3.4 · 7.3.5 · 7.4.0 · 7.4.1 |
| nvd | oracle | retail xstore point of service | generic | 16.0.6 · 17.0.4 · 18.0.3 · 19.0.2 |
| nvd | oracle | webcenter portal | generic | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | weblogic server | generic | 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| nvd | xstream | xstream | generic | ＜ 1.4.16 |
| Published | 2021-03-23 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-09-14 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-09-14 | Most recent commit touching this CVE's classification, patch or rule file. |