Arbitrary file upload in NetApp Snapmanager
CVE-2021-39139
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.045 (91.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.045 · newest: 0.045 · change: 0.000
Affected products
- NetApp Snapmanager
- Oracle Business Activity Monitoring — versions 12.2.1.4.0
- Oracle Commerce Guided Search — versions 11.3.2
- Oracle Communications Billing And Revenue Management Elastic Charging Engine — versions 11.3, 12.0
- Oracle Communications Cloud Native Core Automated Test Suite — versions 1.9.0
- Oracle Communications Cloud Native Core Binding Support Function — versions 1.10.0
- Oracle Communications Cloud Native Core Policy — versions 1.14.0
- Oracle Communications Unified Inventory Management — versions 7.3.4, 7.3.5, 7.4.0
- Oracle Retail Xstore Point Of Service — versions 16.0.6, 17.0.4, 18.0.3
- Oracle Utilities Framework — versions 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0
Weakness classification (CWE)
References
- github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44 (Third Party Advisory)
- x-stream.github.io/CVE-2021-39139.html (Vendor Advisory)
- lists.debian.org/debian-lts-announce/2021/09/msg00017.html (mailing-list, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- www.debian.org/security/2021/dsa-5004 (vendor-advisory, Third Party Advisory)
- www.oracle.com/security-alerts/cpujan2022.html (Patch, Third Party Advisory)
- security.netapp.com/advisory/ntap-20210923-0003/ (Third Party Advisory)
- www.oracle.com/security-alerts/cpuapr2022.html (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-39139?
- CVE-2021-39139 is a high-severity vulnerability in NetApp Snapmanager, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.5/10. Published 2021-08-23.
- How severe is CVE-2021-39139?
- High severity. CVSS v3 base score is 8.5 out of 10.