« Volver al listado

CVE-2024-47072

Estado: AplazadaAlta (7.5)—

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N permite explotación remota sin privilegios (T1190). La manipulación de entrada causa stack overflow → negación de servicio (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Xstream — XstreamAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47072",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47072",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-08T15:17:42.864003Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "x-stream",
          "product": "xstream",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.4.21"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:x-stream:x-stream:*:*:*:*:*:*:*:*"
          ],
          "vendor": "x-stream",
          "product": "x-stream",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.4.21",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-08T00:15:14.937",
  "references": [
    {
      "url": "https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://x-stream.github.io/CVE-2024-47072.html",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        },
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."
    },
    {
      "lang": "es",
      "value": "XStream es una librería sencilla para serializar objetos en formato XML y viceversa. Esta vulnerabilidad puede permitir que un atacante remoto finalice la aplicación con un error de desbordamiento de pila que resulte en una denegación de servicio solo al manipular el flujo de entrada procesado cuando XStream está configurado para usar BinaryStreamDriver. Se ha aplicado un parche a XStream 1.4.21 para detectar la manipulación en el flujo de entrada binario que causa el desbordamiento de pila y genera una InputManipulationException en su lugar. Se recomienda a los usuarios que actualicen la versión. Los usuarios que no puedan actualizar la versión pueden detectar el StackOverflowError en el código del cliente que llama a XStream si XStream está configurado para usar BinaryStreamDriver."
    }
  ],
  "lastModified": "2026-06-17T07:56:29.670",
  "sourceIdentifier": "security-advisories@github.com"
}