NetSight
IP …
critical9.8

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

Impact

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Affected products

VendorProductAffected versions
XstreamXstream
Version 1.4.10
OracleBanking Platform
from 2.4.0 through 2.10.0
Versions 2.4.0, 2.7.1, 2.9.0
OracleBusiness Activity Monitoring
Versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Billing And Revenue Management Elastic Charging Engine
Versions 11.3.0.9.0, 12.0.0.3.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Unified Inventory Management
Versions 7.3.0, 7.4.0
OracleEndeca Information Discovery Studio
Versions 3.2.0, 3.2.0.0
OracleRetail Xstore Point Of Service
Version 17.0
OracleUtilities Framework
from 4.3.0.1.0 through 4.3.0.6.0
Versions 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0
OracleWebcenter Portal
Versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

Weakness classification

CWE-94CWE-502

References