CVE-2019-10173 HIGH

CVE-2019-10173

Vendor Xstream
Product xstream
Weakness CWE-94 · Code injection
Published July 23, 2019
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Key dates

02Disclosure timeline

July 23, 2019 CVE published
August 4, 2024 Record updated