Detections
Analytics
CVE-2013-7285
critical
Description
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
References
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html
https://github.com/andikahilmy/CVE-2020-26259-xstream-vulnerable
https://github.com/andikahilmy/CVE-2020-26258-xstream-vulnerable
https://github.com/andikahilmy/CVE-2020-26217-xstream-vulnerable
https://github.com/shoucheng3/x-stream__xstream_CVE-2021-21345_1-4-15
https://github.com/epicosy/XStream-1
https://github.com/advisories/GHSA-4cch-wxpw-8p28
https://github.com/advisories/GHSA-jfvx-7wrx-43fh
https://github.com/advisories/GHSA-mw36-7c6c-q4q2
https://github.com/advisories/GHSA-f554-x222-wgf7
https://x-stream.github.io/CVE-2013-7285.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0463
http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html