CVE-2021-21346 @ Maven-com.thoughtworks.xstream:xstream-1.4.5

[smaguilarcx]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2021-21346
Checkmarx Project: smaguilarcx/Webgoat_eu_CxOne
Repository URL: https://github.com/smaguilarcx/Webgoat_eu_CxOne
Branch: main
Scan ID: 018a211a-4082-43ef-8ac8-003ac2388229

---

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 1.4.20