CVE-2013-7285

critical

Description

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

References

Advisories
More

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html

https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html

http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html

http://seclists.org/oss-sec/2014/q1/69

https://github.com/andikahilmy/CVE-2020-26259-xstream-vulnerable

https://github.com/andikahilmy/CVE-2020-26258-xstream-vulnerable

https://github.com/andikahilmy/CVE-2020-26217-xstream-vulnerable

https://github.com/shoucheng3/x-stream__xstream_CVE-2021-21345_1-4-15

https://github.com/epicosy/XStream-1

https://github.com/advisories/GHSA-4cch-wxpw-8p28

https://github.com/advisories/GHSA-jfvx-7wrx-43fh

https://github.com/advisories/GHSA-mw36-7c6c-q4q2

https://github.com/advisories/GHSA-f554-x222-wgf7

https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E

https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E

Details

Source: Mitre, NVD

Published: 2019-05-15

Updated: 2025-05-23

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.84362