CVE-2013-7285Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed inpu…
Updated under an hour ago ()
Does this affect you?
It affects oracle endeca_information_discovery_studio and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Analyzed
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
oracle endeca_information_discovery_studio oracle:endeca_information_discovery_studio | 3.2.0 | NVD |
apache activemq apache:activemq | 5.15.8 | NVD |
xstream xstream xstream:xstream | through 1.4.6; 1.4.10 | NVD |
References
- http://seclists.org/oss-sec/2014/q1/69mailing-list, x-refsource-mlist
- https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlmailing-list, x-refsource-mlist
- https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlmailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Emailing-list, x-refsource-mlist
- http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlx-refsource-misc
- https://x-stream.github.io/CVE-2013-7285.htmlx-refsource-confirm
- https://www.oracle.com/security-alerts/cpuoct2020.htmlx-refsource-misc
- http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.