Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2020-26258
Severity
7.7HIGH
EPSS
93.7%
top 0.15%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedDec 16
Latest updateAug 22
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does …
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 1.8 | Impact: 4.0
Affected Packages6 packages
Also affects: Debian Linux 10.0, 9.0, Fedora 33, 34, 35
🔴Vulnerability Details
7💥Exploits & PoCs
1Nuclei▶
XStream <1.4.15 - Server-Side Request Forgery
📋Vendor Advisories
5Red Hat
▶
Debian▶
CVE-2020-26258: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...↗2020