CVE-2013-7285

CRITICAL NUCLEI

Xstream API <1.4.6, 1.4.10 - RCE

Title source: llm

Description

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Exploits (2)

exploitdb WORKING POC

by Brian D. Hysell · textwebappsjava

https://www.exploit-db.com/exploits/39193

View Code ZIP pw:eip

nomisec STUB

by shoucheng3 · poc

https://github.com/shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-6

View Code ZIP pw:eip

Nuclei Templates (1)

XStream <1.4.6/1.4.10 - Remote Code Execution

CRITICALby pwnhxl,vicrack

References (9)

[Broken Link, Not Applicable, URL Repurposed] http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html

[Mailing List, Third Party Advisory] http://seclists.org/oss-sec/2014/q1/69

[Third Party Advisory] http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html

[Mailing List] https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E

[Mailing List] https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E

[Third Party Advisory] https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html

[Third Party Advisory] https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html

[Third Party Advisory] https://www.oracle.com/security-alerts/cpuoct2020.html

[Exploit, Third Party Advisory] https://x-stream.github.io/CVE-2013-7285.html

Scores

CVSS v3 9.8

EPSS 0.1482

EPSS Percentile 94.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (5)

apache/activemq 5.15.8

com.thoughtworks.xstream/xstream 0 - 1.4.7Maven

oracle/endeca_information_discovery_studio 3.2.0

xstream/xstream 1.4.10

xstream/xstream < 1.4.6

Published May 15, 2019

Tracked Since Feb 18, 2026