How severe is CVE-2021-39140?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.3 out of 10.

What type of vulnerability is CVE-2021-39140?

This is classified as CWE-502, which is a common weakness in software security.

CVE-2021-39140

MEDIUM Year: 2021

CVSS v3 Score

6.3

Medium

CVSS v2 Score

6.3

Medium

Weakness Type

CWE-502

View all →

Vulnerability Description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVE-2020-4271

MEDIUM

CVSS:6.3(Medium)

IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted command which would be executed as a lower privileged user. IBM X-ForceID: 175897.

CWE-5022020

CVE-2020-4280

MEDIUM

CVSS:6.3(Medium)

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function....

CWE-5022020

CVE-2020-4888

MEDIUM

CVSS:6.3(Medium)

IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content...

CWE-5022020

CVE-2021-1413

MEDIUM

CVSS:6.3(Medium)

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary...

CWE-5022021