UpHeron
All vulnerabilities

Servers and applications

CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of…

Severity
High 7.7
Published
16 Dec 2020
Last changed
7 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.0.0
Sources
NVD

Affected software

SoftwareAffected versions
Apache StrutsServers and applications · cpe:a:apache:struts
  • Every version before 6.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-26258
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-26258