Deserialization of untrusted data

2019-07-2313:15:00

PRIOn knowledge base

www.prio-n.com

8.2 High

AI Score

Confidence

High

0.942 High

EPSS

Percentile

99.2%

JSON

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

CPENameOperatorVersion
banking_platformeq2.4.0
banking_platformeq2.7.1
banking_platformeq2.9.0
banking_platformge2.4.0
banking_platformle2.10.0
business_activity_monitoringeq12.2.1.3.0
business_activity_monitoringeq11.1.1.9.0
business_activity_monitoringeq12.2.1.4.0
communications_billing_and_revenue_management_elastic_charging_engineeq11.3.0.9.0
communications_billing_and_revenue_management_elastic_charging_engineeq12.0.0.3.0

Name	Operator	Version
banking_platform	eq	2.4.0
banking_platform	eq	2.7.1
banking_platform	eq	2.9.0
banking_platform	ge	2.4.0
banking_platform	le	2.10.0
business_activity_monitoring	eq	12.2.1.3.0
business_activity_monitoring	eq	11.1.1.9.0
business_activity_monitoring	eq	12.2.1.4.0
communications_billing_and_revenue_management_elastic_charging_engine	eq	11.3.0.9.0
communications_billing_and_revenue_management_elastic_charging_engine	eq	12.0.0.3.0