CVE-2021-21342

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.16

Description The issue is related to the deserialization mechanism in the XStream Java library, which is used for converting objects to XML or JSON formats. An attacker can exploit this by manipulating the input stream, allowing them to access protected information and forge requests on the server-side. This can be done by replacing or injecting objects based on the type information in the processed stream. Users who have set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

Recommendations To resolve the issue, use at least version 1.4.16 of XStream if you rely on the default blacklist of the Security Framework. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types to minimize the risk of exploitation.