EXPOSURES › CVE-2013-7285
CVE-2013-7285
CRITICAL
DETAIL
SourceNVD · cve
Published2019-05-15
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2013-7285 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
DESCRIPTION
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
Apache's Xstream API flaw allowed remote code execution, a critical vulnerability that was widely recognized as severe despite the vendor's eventual patch.
NVD entry confirms the severity of the vulnerability, allowing arbitrary shell command execution, which is a critical security flaw.
"may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON."
No usable content; the source returned a connection error and provides no information on the vulnerability or vendor response.
AFFECTED FEDRAMP PRODUCTS · 10
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |