Technical Severity
HIGH
CVSS v3.1 Metrics
8.5
/ 10
Minimal Risk
Critical
Vector Specification
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitation Likelihood
EPSS Prediction
94.38
%
Predictive Probability
Percentile Rank
100.0
th
Documented as more likely to be exploited than 100.0% of known CVEs.
Detection Date
Mar 10, 2023
Remediation Due
Mar 31, 2023
CISA Catalog Active
Threat Analysis
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
Remediation Directive
Apply updates per vendor instructions.