Critical Severity Vulnerability
This vulnerability has been rated as Critical severity. Immediate action is recommended.
CVE-2013-7285
Critical
Low
Medium
High
Critical
9.8
CVSS Score
Vulnerability Description
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
H
Integrity
H
Availability
H
Known Affected Software
3 configuration(s) from 3 vendor(s)
activemq
Version:
5.15.8
CPE:
cpe:2.3:a:apache:activemq:5.15.8:*:*:*:*:*:*:*
endeca_information_discovery_studio
Version:
3.2.0
CPE:
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*
xstream
Version:
1.4.10
CPE:
cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:*
This vulnerability affects 3 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlcve@mitre.org Not Applicable URL Repurposed Broken Link
-
http://seclists.org/oss-sec/2014/q1/69cve@mitre.org Mailing List Third Party Advisory
-
http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlcve@mitre.org Third Party Advisory
-
https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Ecve@mitre.org Mailing List
-
https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3Ecve@mitre.org Mailing List
-
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlcve@mitre.org Third Party Advisory
-
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlcve@mitre.org Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuoct2020.htmlcve@mitre.org Third Party Advisory
-
https://x-stream.github.io/CVE-2013-7285.htmlcve@mitre.org Exploit Third Party Advisory
-
http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlaf854a3a-2127-422b-91ae-364da2661108 Not Applicable URL Repurposed Broken Link
-
http://seclists.org/oss-sec/2014/q1/69af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List
-
https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3Eaf854a3a-2127-422b-91ae-364da2661108 Mailing List
-
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuoct2020.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://x-stream.github.io/CVE-2013-7285.htmlaf854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
Severity Details
9.8
out of 10.0
Critical
Weakness Type (CWE)
CWE-78
Top 25 #13
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Description
- The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a…
- Exploit Likelihood
- High
- Typical Severity
- High
- OWASP Top 10
- A03:2021-Injection
- Abstraction Level
- Base
Key Information
- Published Date
- May 15, 2019
