CVE-2013-7285 Public exploit EPSS 84.4%

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a…

Summary

The flaw is in the XStream API, a Java library used for serializing and deserializing XML and other formats such as JSON, in versions up to 1.4.6 and in version 1.4.10 when its security framework has not been initialized.

Official description · CVE.org

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Breakdown

24.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) was available 3 years before disclosure.

Public exploit codeExploit-DB7 Jan 20163 yrs before
Disclosed15 May 2019day 0

See the family tree

A fix was bypassed or incomplete once over 8 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2017-7957XStream through 1.4.9, when a certain denyTypes workaround is…29 Apr 2017
relatedMedium
Why these are linked:
- Same code patched: XStream.java, PrimitiveTypePermission.java (machine-matched)Functions: XStream, autodetectAnnotationscommit 6344867 commit 6e546ec commit 8542d02
This CVECVE-2013-7285Xstream API versions up to 1.4.6 and version 1.4.10, if the…15 May 2019
regression ofHigh
Why these are linked:
- Stated in the CVE textIf the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2019-10173It was found that xstream API version 1.4.10 before 1.4.11…23 Jul 2019
Next fix in the same packageLow
Why these are linked:
- Fixed one release later1.4.11 → 1.4.14-java7 (com.thoughtworks.xstream:xstream)
CVE-2020-26217Remote Code Execution in XStream16 Nov 2020
same family
CVE-2021-43859Denial of Service by injecting highly recursive collections or…1 Feb 2022
relatedMedium
Why these are linked:
- Same code patched: website.xml (machine-matched)commit e8e8862 commit bb838ce commit fdd9f7d
CVE-2024-47072XStream is vulnerable to a Denial of Service attack due to stack…7 Nov 2024

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: com.thoughtworks.xstream:xstream.

Mavencom.thoughtworks.xstream:xstreamGHSA-f554-x222-wgf7

Upgrade to 1.4.18 or later

Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2019-10173, CVE-2020-26217, +10).

Set the version to 1.4.18 or later in your pom.xml or build.gradle.

First fixed in 1.4.11 for CVE-2013-7285.

Affected versions, by release line

If you run	Upgrade to
1.4.10 up to 1.4.11	1.4.18first fix for this CVE: 1.4.11
All versions before 1.4.7 Still affected on this line by CVE-2020-26217 (fixed in 1.4.14-java7, a newer line); CVE-2020-26258 (fixed in 1.4.15, a newer line); CVE-2020-26259 (fixed in 1.4.15, a newer line); CVE-2021-21341 (fixed in 1.4.16, a newer line); CVE-2021-21344 (fixed in 1.4.16, a newer line); CVE-2021-21345 (fixed in 1.4.16, a newer line); CVE-2021-21346 (fixed in 1.4.16, a newer line); CVE-2021-21351 (fixed in 1.4.16, a newer line); CVE-2021-29505 (fixed in 1.4.17, a newer line); CVE-2021-39144 (fixed in 1.4.18, a newer line); CVE-2021-39152 (fixed in 1.4.18, a newer line).	1.4.7

If you run

Upgrade to

1.4.10 up to 1.4.11

1.4.18first fix for this CVE: 1.4.11

All versions before 1.4.7

Still affected on this line by CVE-2020-26217 (fixed in 1.4.14-java7, a newer line); CVE-2020-26258 (fixed in 1.4.15, a newer line); CVE-2020-26259 (fixed in 1.4.15, a newer line); CVE-2021-21341 (fixed in 1.4.16, a newer line); CVE-2021-21344 (fixed in 1.4.16, a newer line); CVE-2021-21345 (fixed in 1.4.16, a newer line); CVE-2021-21346 (fixed in 1.4.16, a newer line); CVE-2021-21351 (fixed in 1.4.16, a newer line); CVE-2021-29505 (fixed in 1.4.17, a newer line); CVE-2021-39144 (fixed in 1.4.18, a newer line); CVE-2021-39152 (fixed in 1.4.18, a newer line).

1.4.7

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

9 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2019-0463

OpenMRS Reporting Module 0.9.7 - Remote Code ExecutionEDB-39193 · webapps · java · 2016-01-07

, 30 Oct 2026

84.4%Top 0.3%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.7%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9970 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.9

Record

Published: 15 May 2019
Modified: 8 Oct 2026
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

mailing-list 5

x_refsource_MISC 3

x_refsource_CONFIRM 1

techniques