CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2021-391448.5/HIGHEPSS 98.1%CISA KEV

2021-08-23

XStream XML Deserialization Remote Code Execution Vulnerability (CVE-2021-39144) Security Advisory

[Affected Scope] Java applications utilizing XStream library versions prior to 1.4.18, and third-party solutions like VMware NSX Manager embedding this library

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by manipulating the processed XML input stream

[Mitigation] Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist

CWE-502 CWE-94 deserialization rce kev-exploit

Full Advisory & Mitigation

CVE-2017-98058.1/HIGHEPSS 99.4%CISA KEV

2017-09-15

Apache Struts 2 REST Plugin XML Deserialization Remote Code Execution Vulnerability (CVE-2017-9805, S2-052)

[Affected Scope] Apache Struts versions 2.1.1 through 2.3.33 and 2.5 through 2.5.12 using the REST plugin

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending malicious XML payloads

[Mitigation] Immediately upgrade Apache Struts to version 2.3.34 or 2.5.13 or higher, or restrict/disable XML handling in the REST plugin

struts2 s2-052 xstream deserialization rce CWE-502

Full Advisory & Mitigation