Published: 15/05/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 756

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote malicious user to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xstream project xstream
xstream project xstream 1.4.10

Debian Bug report logs - #734821 libxstream-java: CVE-2013-7285: remote code execution via deserialization in XStream Package: libxstream-java; Maintainer for libxstream-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for libxstream-java is src:libxstream-java (PTS, buildd, popcon) Repo ...

Synopsis Important: Red Hat Decision Manager 740 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Decision ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ba ...

Synopsis Important: Red Hat Single Sign-On 736 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 73 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...

Synopsis Important: Red Hat Data Grid 733 security update Type/Severity Security Advisory: Important Topic An update for Red Hat Data Grid is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Important: Red Hat Process Automation Manager 740 Security Update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scor ...

Synopsis Important: Red Hat Fuse 750 security update Type/Severity Security Advisory: Important Topic A minor version update (from 74 to 75) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security h ...

Synopsis Important: Red Hat JBoss Fuse/A-MQ 63 R14 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Fuse 63 and Red Hat JBoss A-MQ 63Red Hat Product Security has rated this update as having a security impact of Important A Common ...

Impact: Important Public Date: 2013-12-22 CWE: CWE-94 Bugzilla: 1051277: CVE-2013-7285 XStream: remote ...

Title: Unauthenticated remote code execution in OpenMRS Product: OpenMRS Vendor: OpenMRS Inc Tested versions: See summary Status: Fixed by vendor Reported by: Brian D Hysell Product description: OpenMRS is "the world's leading open source enterprise electronic medical record system platform" Vulnerability summary: The OpenMRS Reporting Modul ...

OpenMRS Reporting module version 097 suffers from a remote code execution vulnerability ...

To demo security issues specific to xstream v1.4.11. Look at https://github.com/pkrajanand/xstream_v1_4_9_security_issues for v1.4.9 behaviour

Overview This repository contains the junit tests to demonstrate how XStream v1411 respond to the security issues x-streamgithubio/CVE-2013-7285html and x-streamgithubio/CVE-2017-7957html Summary on behaviour through v147 to v14111 A way to deal with CVE_2013_7285 is provided through v147 But issue again is showed up while fixing CVE-2017-7957 in

To demo security issues specific to xstream v1.4.11. Look at https://github.com/pkrajanand/xstream_v1_4_9_security_issues for v1.4.9 behaviour

Overview This repository contains the junit tests to demonstrate how XStream v1411 respond to the security issues x-streamgithubio/CVE-2013-7285html and x-streamgithubio/CVE-2017-7957html Summary on behaviour through v147 to v14111 A way to deal with CVE_2013_7285 is provided through v147 But issue again is showed up while fixing CVE-2017-7957 in

To demo security issues specific to xstream v1.4.9. Go to https://github.com/pkrajanand/xstream_1_4_11_security_issues for v1.4.11

Overview This repository contains the junit tests to demonstrate how XStream v149 respond to the security issues x-streamgithubio/CVE-2013-7285html and x-streamgithubio/CVE-2017-7957html Summary on behaviour through v147 to v14111 A way to deal with CVE_2013_7285 is provided through v147 But issue again is showed up while fixing CVE-2017-7957 in v

To demo security issues specific to xstream v1.4.9. Go to https://github.com/pkrajanand/xstream_1_4_11_security_issues for v1.4.11

Overview This repository contains the junit tests to demonstrate how XStream v149 respond to the security issues x-streamgithubio/CVE-2013-7285html and x-streamgithubio/CVE-2017-7957html Summary on behaviour through v147 to v14111 A way to deal with CVE_2013_7285 is provided through v147 But issue again is showed up while fixing CVE-2017-7957 in v

CWE-78 https://x-stream.github.io/CVE-2013-7285.html http://seclists.org/oss-sec/2014/q1/69 http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html https://www.oracle.com/security-alerts/cpuoct2020.html http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734821 https://nvd.nist.gov https://www.exploit-db.com/exploits/39193/https://github.com/pkrajanand/xstream_1_4_11_security_issues https://access.redhat.com/security/cve/cve-2013-7285

CVE-2013-7285

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect