GHSA-F554-X222-WGF7 Command Injection in Xstream

🗓️ 29 May 2019 18:05:03Reported by GoogleType

osv

osv🔗 osv.dev👁 4 Views

Xstream command injection allows code execution during unmarshalling when security is uninitialized.

Reporter	Title	Published	Views	Family All 93
0day.today	OpenMRS Reporting Module 0.9.7 - Remote Code Execution	7 Jan 201600:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Aug 202122:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities	19 Aug 201920:44	–	ibm
IBM Security Bulletins	Security Bulletin: XStream as used by IBM QRadar SIEM is vulnerable to OS command injection (CVE-2019-10173)	20 Nov 201917:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ	20 Feb 202012:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Xstream affect IBM InfoSphere Information Server	1 Nov 201920:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream and Apache MINA might affect IBM Storage Defender Copy Data Management.	16 May 202519:22	–	ibm
FreeBSD	jenkins -- multiple vulnerabilities	14 Feb 201400:00	–	freebsd
Tenable Nessus	Artifactory < 3.1.1.1 XStream Remote Code Execution	12 Mar 201400:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-7285
github	www.github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d
lists	www.lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E
lists	www.lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
mail-archive	www.mail-archive.com/[email protected]/msg00604.html
mail-archive	www.mail-archive.com/[email protected]/msg00607.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
x-stream	www.x-stream.github.io/CVE-2013-7285.html
blog	www.blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
seclists	www.seclists.org/oss-sec/2014/q1/69

05 Mar 2024 00:01Current

7.2High risk

Vulners AI Score7.2

CVSS 39.8

EPSS0.84362

xstream command injection remote code execution unmarshalling security framework uninitialized versions affected