CVE:CVE-2021-21349
CNNVD:CNNVD-202103-1236
XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。
XStream 1.4.16 之前版本存在代码问题漏洞，该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。
solution:Upgrade xstream_project xstream to a higher version than 1.4.16,and avoid the version (,1.4.16); Upgrade debian debian_linux to a higher version than 9.0,10.0,11.0,and avoid the version 9.0,10.0,11.0; Upgrade fedoraproject fedora to a higher version than 33,34,35,and avoid the version 33,34,35; Upgrade oracle banking_enterprise_default_management to a higher version than 2.10.0,2.12.0,and avoid the version 2.10.0,2.12.0; Upgrade oracle banking_platform to a higher version than 2.4.0,2.7.1,2.9.0,2.12.0,and avoid the version 2.4.0,2.7.1,2.9.0,2.12.0; Upgrade oracle banking_virtual_account_management to a higher version than 14.2.0,14.3.0,14.5.0,and avoid the version 14.2.0,14.3.0,14.5.0; Upgrade oracle business_activity_monitoring to a higher version than 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0,and avoid the version 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0; Upgrade oracle communications_billing_and_revenue_management_elastic_charging_engine to a higher version than 12.0.0.3.0,and avoid the version 12.0.0.3.0; Upgrade oracle communications_policy_management to a higher version than 12.5.0,and avoid the version 12.5.0; Upgrade oracle communications_unified_inventory_management to a higher version than 7.3.2,7.3.4,7.3.5,7.4.0,7.4.1,and avoid the version 7.3.2,7.3.4,7.3.5,7.4.0,7.4.1; Upgrade oracle graalvm to a higher version than 20.3.4,21.3.0,and avoid the version 20.3.4,21.3.0; Upgrade oracle java_se to a higher version than 7u321,8u311,and avoid the version 7u321,8u311; Upgrade oracle retail_xstore_point_of_service to a higher version than 16.0.6,17.0.4,18.0.3,19.0.2,and avoid the version 16.0.6,17.0.4,18.0.3,19.0.2; Upgrade oracle webcenter_portal to a higher version than 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0,and avoid the version 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0