CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-10173
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Severity
- EPSS
- 95% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oracle:banking_platform
- oracle:business_activity_monitoring
- oracle:communications_billing_and_revenue_management_elastic_charging_engine
- oracle:communications_diameter_signaling_router
- oracle:communications_unified_inventory_management
- oracle:endeca_information_discovery_studio
- oracle:retail_xstore_point_of_service
- oracle:utilities_framework
- oracle:webcenter_portal
- xstream:xstream
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hf23-9pf7-388p | Maven | com.thoughtworks.xstream:xstream | >=1.4.10 <1.4.11 | 1.4.11 |