CVE-2019-10173
critical · 9.8It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
9.8
CVSS
95.0%
EPSS (exploit prob.)
100th
EPSS percentile
2019-07-23
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94CWE-502
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| xstream | xstream | 1.4.10 |
| oracle | banking_platform | >= 2.4.0, <= 2.10.0 |
| oracle | banking_platform | 2.4.0 |
| oracle | banking_platform | 2.7.1 |
| oracle | banking_platform | 2.9.0 |
| oracle | business_activity_monitoring | 11.1.1.9.0 |
| oracle | business_activity_monitoring | 12.2.1.3.0 |
| oracle | business_activity_monitoring | 12.2.1.4.0 |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 11.3.0.9.0 |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | 12.0.0.3.0 |
| oracle | communications_diameter_signaling_router | >= 8.0.0, <= 8.2.2 |
| oracle | communications_unified_inventory_management | 7.3.0 |
| oracle | communications_unified_inventory_management | 7.4.0 |
| oracle | endeca_information_discovery_studio | 3.2.0 |
| oracle | endeca_information_discovery_studio | 3.2.0.0 |
| oracle | retail_xstore_point_of_service | 17.0 |
| oracle | utilities_framework | >= 4.3.0.1.0, <= 4.3.0.6.0 |
| oracle | utilities_framework | 2.2.0.0.0 |
| oracle | utilities_framework | 4.2.0.2.0 |
| oracle | utilities_framework | 4.2.0.3.0 |
| oracle | utilities_framework | 4.4.0.0.0 |
| oracle | webcenter_portal | 11.1.1.9.0 |
| oracle | webcenter_portal | 12.2.1.3.0 |
| oracle | webcenter_portal | 12.2.1.4.0 |
Check a specific version with /api/v1/cve/match.
References
- http://x-stream.github.io/changes.html#1.4.11
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4352
- https://access.redhat.com/errata/RHSA-2020:0445
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://x-stream.github.io/changes.html#1.4.11
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4352
- https://access.redhat.com/errata/RHSA-2020:0445
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-10173