Executive brief
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Affected products
- Maven com.thoughtworks.xstream:xstream
Junglewise Threat Intelligence
CVE-2021-39150: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resourc
CVE-2021-39150 · Severity: low · CVSS 3.1 · Published 2021-08-25
Technologies: com.thoughtworks.xstream:xstream (Maven). Vendors: Maven.
Related threats
- XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
- XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow
- XStream can cause Denial of Service via stack overflow
- Duplicate Advisory: Denial of Service due to parser crash
- Denial of Service by injecting highly recursive collections or maps in XStream