Is CVE-2021-21349 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 48%.

What products does CVE-2021-21349 affect?

Tracked products affected include ActiveMQ. Check the version you run to see whether it is affected.

How do I fix CVE-2021-21349?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2021-21349

Q: What is CVE-2021-21349?

CVE-2021-21349 is a medium-severity software vulnerability (Insecure deserialization) with a CVSS score of 6.1. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only

MEDIUM severity · CVSS 6.1 · Insecure deserialization

6.1CVSS MEDIUM

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionRequired

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)48%

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected products we track (1)

ActiveMQ

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2021-21349

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information