CVE-2019-10173 High · 7.3 EPSS 95.0%

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw

xstream · xstream

Summary

A regression in the XStream library (product: XStream, the XML/JSON serialization API) introduced in version 1.4.10 and fixed in 1.4.11 reopens a previous deserialization flaw. When the security framework has not been initialized, a remote attacker can run arbitrary shell commands by supplying crafted XML or other supported formats such as JSON for unmarshalling, with no authentication or user interaction required.

Official description · CVE.org

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Breakdown

25.1 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 23 Jul 2019. No public exploit code or confirmed exploitation is recorded.

See the family tree

A fix was bypassed or incomplete once over 8 years. The latest fix listed for xstream is 1.4.15.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2017-7957XStream through 1.4.9, when a certain denyTypes workaround is…29 Apr 2017
relatedMedium
Why these are linked:
- Same code patched: XStream.java, PrimitiveTypePermission.java (machine-matched)Functions: XStream, autodetectAnnotationscommit 6344867 commit 6e546ec commit 8542d02
CVE-2013-7285Xstream API versions up to 1.4.6 and version 1.4.10, if the…15 May 2019
regression ofHigh
Why these are linked:
- Stated in the CVE textIf the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
- Similar weakness in the same product (machine-matched)same package + description similarity
This CVECVE-2019-10173It was found that xstream API version 1.4.10 before 1.4.11…23 Jul 2019
Next fix in the same packageLow
Why these are linked:
- Fixed one release later1.4.11 → 1.4.14-java7 (com.thoughtworks.xstream:xstream)
CVE-2020-26217Remote Code Execution in XStream16 Nov 2020
same family
CVE-2021-43859Denial of Service by injecting highly recursive collections or…1 Feb 2022
relatedMedium
Why these are linked:
- Same code patched: website.xml (machine-matched)commit e8e8862 commit bb838ce commit fdd9f7d
CVE-2024-47072XStream is vulnerable to a Denial of Service attack due to stack…7 Nov 2024

Fixes in xstreamMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.4.9CVE-2016-367417 May 2016
1.4.10CVE-2017-795729 Apr 2017
1.4.11CVE-2013-728515 May 2019
1.4.11CVE-2019-1017323 Jul 2019
1.4.14-java7CVE-2020-2621716 Nov 2020
1.4.15CVE-2020-2625816 Dec 2020
1.4.15CVE-2020-2625916 Dec 2020Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: com.thoughtworks.xstream:xstream.

Mavencom.thoughtworks.xstream:xstreamGHSA-hf23-9pf7-388p

Upgrade to 1.4.18 or later

Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2013-7285, CVE-2020-26217, +10).

Set the version to 1.4.18 or later in your pom.xml or build.gradle.

First fixed in 1.4.11 for CVE-2019-10173.

Affected versions

If you run	Upgrade to
1.4.10 up to 1.4.11	1.4.18first fix for this CVE: 1.4.11

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

11 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2019-0591

No public exploit code found.

, 30 Oct 2026

95.0%Top 0.14%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.86%).

3.0

7.3High · 7.3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9986 20.0/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 7.3 5.1/7

End-of-life productsupported or unknown 0.0

Total25.1

Record

Published: 23 Jul 2019
Modified: 4 Aug 2024
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in xstreamMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

vendor-advisory 4

x_refsource_MISC 6

x_refsource_CONFIRM 1

techniques