{"id":"CVE-2013-7285","published":"2019-05-15T16:54:57Z","modified":"2026-10-08T21:03:14Z","title":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the XStream API, a Java library used for serializing and deserializing XML and other formats such as JSON, in versions up to 1.4.6 and in version 1.4.10 when its security framework has not been initialized.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:49Z"},"cvss":null,"epss":{"score":0.84362,"percentile":0.99698,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://seclists.org/oss-sec/2014/q1/69","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["x_refsource_MISC"]},{"url":"https://x-stream.github.io/CVE-2013-7285.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":["<1.4.7",">=1.4.10, <1.4.11"],"patched":["1.4.7","1.4.11"],"from":["GHSA-f554-x222-wgf7"],"provenance":"source"}],"advisories":[{"id":"GHSA-f554-x222-wgf7","url":"https://github.com/advisories/GHSA-f554-x222-wgf7","severity":"CRITICAL","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":["<1.4.7"],"patched":["1.4.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f554-x222-wgf7","url":"https://github.com/advisories/GHSA-f554-x222-wgf7","severity":"CRITICAL","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":[">=1.4.10, <1.4.11"],"patched":["1.4.11"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2019-0463","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0463","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":39193,"url":"https://www.exploit-db.com/exploits/39193","title":"OpenMRS Reporting Module 0.9.7 - Remote Code Execution","type":"webapps","platform":"java","date":"2016-01-07","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-01-07"},"nuclei":[{"id":"CVE-2013-7285","name":"XStream <1.4.6/1.4.10 - Remote Code Execution","severity":"critical","path":"http/cves/2013/CVE-2013-7285.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7285.yaml"}],"first":{"date":"2016-01-07","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39193"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2016-01-07","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-39193)","url":"https://www.exploit-db.com/exploits/39193","provenance":"source"},{"date":"2019-05-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2013-7285","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-x-stream-xstream-cve-2017-7957","parents":[{"from":"CVE-2017-7957","to":"CVE-2013-7285","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xstream/src/java/com/thoughtworks/xstream/XStream.java","xstream/src/java/com/thoughtworks/xstream/security/PrimitiveTypePermission.java"],"commits":["https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d","https://github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604abe","https://github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d3"],"basis":"shared function","functions":["XStream","autodetectAnnotations"]}]}],"children":[{"from":"CVE-2013-7285","to":"CVE-2019-10173","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","from":"CVE.org","in":"CVE-2019-10173"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same package + description similarity"}]},{"from":"CVE-2013-7285","to":"CVE-2021-43859","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xstream-distribution/src/content/website.xml","xstream/src/java/com/thoughtworks/xstream/XStream.java","xstream/src/java/com/thoughtworks/xstream/security/ForbiddenClassException.java"],"commits":["https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d","https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846"],"basis":"shared function","functions":["XStream"]}]}]}}