Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Published

2019-07-23T13:15:13.177

Last Modified

2025-05-14T20:02:54.240

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-94
  • Type: Secondary
    CWE-502
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application xstream xstream 1.4.10 Yes
Application oracle banking_platform ≤ 2.10.0 Yes
Application oracle banking_platform 2.4.0 Yes
Application oracle banking_platform 2.7.1 Yes
Application oracle banking_platform 2.9.0 Yes
Application oracle business_activity_monitoring 11.1.1.9.0 Yes
Application oracle business_activity_monitoring 12.2.1.3.0 Yes
Application oracle business_activity_monitoring 12.2.1.4.0 Yes
Application oracle communications_billing_and_revenue_management_elastic_charging_engine 11.3.0.9.0 Yes
Application oracle communications_billing_and_revenue_management_elastic_charging_engine 12.0.0.3.0 Yes
Application oracle communications_diameter_signaling_router ≤ 8.2.2 Yes
Application oracle communications_unified_inventory_management 7.3.0 Yes
Application oracle communications_unified_inventory_management 7.4.0 Yes
Application oracle endeca_information_discovery_studio 3.2.0 Yes
Application oracle endeca_information_discovery_studio 3.2.0.0 Yes
Application oracle retail_xstore_point_of_service 17.0 Yes
Application oracle utilities_framework ≤ 4.3.0.6.0 Yes
Application oracle utilities_framework 2.2.0.0.0 Yes
Application oracle utilities_framework 4.2.0.2.0 Yes
Application oracle utilities_framework 4.2.0.3.0 Yes
Application oracle utilities_framework 4.4.0.0.0 Yes
Application oracle webcenter_portal 11.1.1.9.0 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle webcenter_portal 12.2.1.4.0 Yes
References