CVE-2013-7285

🗓️ 15 May 2019 16:54:57Reported by mitreType

cve🔗 web.nvd.nist.gov👁 416 Views🌐 WEB

Xstream API remote code execution vulnerabilit

Reporter	Title	Published	Views	Family All 92
zdt	OpenMRS Reporting Module 0.9.7 - Remote Code Execution	7 Jan 201600:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Aug 202122:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities	19 Aug 201920:44	–	ibm
IBM Security Bulletins	Security Bulletin: XStream as used by IBM QRadar SIEM is vulnerable to OS command injection (CVE-2019-10173)	20 Nov 201917:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ	20 Feb 202012:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Xstream affect IBM InfoSphere Information Server	1 Nov 201920:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream and Apache MINA might affect IBM Storage Defender Copy Data Management.	16 May 202519:22	–	ibm
FreeBSD	jenkins -- multiple vulnerabilities	14 Feb 201400:00	–	freebsd
Tenable Nessus	Artifactory < 3.1.1.1 XStream Remote Code Execution	12 Mar 201400:00	–	nessus

NVD

Node

oracle endeca_information_discovery_studioMatch3.2.0

Node

apache activemqMatch5.15.8

Node

OR

xstream xstreamRange≤1.4.6

xstream xstreamMatch1.4.10

Source	Link
mail-archive	www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html
lists	www.lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
seclists	www.seclists.org/oss-sec/2014/q1/69
blog	www.blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
x-stream	www.x-stream.github.io/CVE-2013-7285.html
web	www.web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
lists	www.lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E
mail-archive	www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html

Parameter	Position	Path	Description	CWE
type	query param	module/reporting/definition/saveSerializedDefinition.form	Unauthenticated remote code execution via crafted serialized input passed to XStream during XML/stream unmarshalling.	CWE-78
serializationClass	query param	module/reporting/definition/saveSerializedDefinition.form	Unauthenticated remote code execution via crafted serialized input passed to XStream during XML/stream unmarshalling.	CWE-78
serializedData	query param	module/reporting/definition/saveSerializedDefinition.form	Unauthenticated remote code execution via crafted serialized input passed to XStream during XML/stream unmarshalling.	CWE-78
uuid	query param	module/reporting/definition/saveSerializedDefinition.form	Unauthenticated remote code execution via crafted serialized input passed to XStream during XML/stream unmarshalling.	CWE-78
name	query param	module/reporting/definition/saveSerializedDefinition.form	Unauthenticated remote code execution via crafted serialized input passed to XStream during XML/stream unmarshalling.	CWE-78
subtype	query param	module/reporting/definition/saveSerializedDefinition.form	Unauthenticated remote code execution via crafted serialized input passed to XStream during XML/stream unmarshalling.	CWE-78

17 Jun 2026 00:01Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.8

EPSS0.84362

cve-2013-7285 xstream api security remote code execution vulnerability unmarshaling xml json nvd