Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-26217

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Published

2020-11-16T21:15:12.893

Last Modified

2025-05-23T16:54:19.697

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.0 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-78
  • Type: Primary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application xstream xstream < 1.4.14 Yes
Operating System debian debian_linux 9.0 Yes
Operating System debian debian_linux 10.0 Yes
Application netapp snapmanager * Yes
Application netapp snapmanager - Yes
Application apache activemq < 5.15.14 Yes
Application apache activemq 5.16.0 Yes
Application oracle banking_cash_management 14.2 Yes
Application oracle banking_cash_management 14.3 Yes
Application oracle banking_cash_management 14.5 Yes
Application oracle banking_corporate_lending_process_management 14.2 Yes
Application oracle banking_corporate_lending_process_management 14.3 Yes
Application oracle banking_corporate_lending_process_management 14.5 Yes
Application oracle banking_credit_facilities_process_management 14.2 Yes
Application oracle banking_credit_facilities_process_management 14.3 Yes
Application oracle banking_credit_facilities_process_management 14.5 Yes
Application oracle banking_platform 2.4.0 Yes
Application oracle banking_platform 2.7.1 Yes
Application oracle banking_platform 2.9.0 Yes
Application oracle banking_supply_chain_finance 14.2 Yes
Application oracle banking_supply_chain_finance 14.3 Yes
Application oracle banking_supply_chain_finance 14.5 Yes
Application oracle banking_trade_finance_process_management 14.2 Yes
Application oracle banking_trade_finance_process_management 14.3 Yes
Application oracle banking_trade_finance_process_management 14.5 Yes
Application oracle banking_virtual_account_management 14.2.0 Yes
Application oracle banking_virtual_account_management 14.3.0 Yes
Application oracle banking_virtual_account_management 14.5.0 Yes
Application oracle business_activity_monitoring 11.1.1.9.0 Yes
Application oracle business_activity_monitoring 12.2.1.3.0 Yes
Application oracle business_activity_monitoring 12.2.1.4.0 Yes
Application oracle communications_policy_management 12.5.0 Yes
Application oracle endeca_information_discovery_studio 3.2.0.0 Yes
Application oracle retail_xstore_point_of_service 16.0.6 Yes
Application oracle retail_xstore_point_of_service 17.0.4 Yes
Application oracle retail_xstore_point_of_service 18.0.3 Yes
Application oracle retail_xstore_point_of_service 19.0.2 Yes
References