{"id":"CVE-2013-7285","aliases":["CLSA-2026-1794218779","DEBIAN-CVE-2013-7285","EUVD-2019-0463","GHSA-f554-x222-wgf7","MGASA-2014-0100","RHSA-2014:0389","UBUNTU-CVE-2013-7285"],"status":"published","title":"Command Injection in Xstream","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.84362,"percentile":0.99701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2014-02-25T21:54:53Z","modified":"2026-11-09T19:15:08Z","exploits":[{"source":"exploitdb","id":"EDB-39193","title":"OpenMRS Reporting Module 0.9.7 - Remote Code Execution","type":"webapps","platform":"java","date":"2016-01-07","url":"https://www.exploit-db.com/exploits/39193"},{"source":"pocgithub","id":"shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-6","title":"shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-6","date":"2025-08-19","url":"https://github.com/shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-6"},{"source":"nuclei","id":"CVE-2013-7285","title":"XStream \u003c1.4.6/1.4.10 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7285.yaml"}],"fixes":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.7","1.4.11"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.2.2-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxstream-java","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxstream-java","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxstream-java","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"xstream","fixed_in":["1.3.1-6.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kxml","fixed_in":["2.3.0-5.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"xstream","fixed_in":["1.4.7-1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"jasperreports-server-pro","fixed_in":["0:5.5.0-6.el6ev"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxstream-java","fixed_in":["1.4.7-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.10"},{"last_affected":"1.4.10"},{"fixed":"1.4.11"}]}],"versions":["1.4.10"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"1.2.2-tuxcare.3"}]}],"versions":["1.2.2","1.2.2-tuxcare.1","1.2.2-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6"]},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.10"},{"fixed":"1.4.11"}]}],"versions":["1.4.10","1.4.10-java7"]},{"source":"osv","ecosystem":"Mageia:3","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-5.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"jasperreports-server-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.0-6.el6ev"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}],"versions":["1.4.4-1"]}],"products":[{"vendor":"apache","product":"activemq"},{"vendor":"oracle","product":"endeca_information_discovery_studio"},{"vendor":"xstream","product":"xstream"}],"references":[{"url":"http://seclists.org/oss-sec/2014/q1/69","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Not Applicable","URL Repurposed","article","web","report"]},{"url":"https://x-stream.github.io/CVE-2013-7285.html","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7285","tags":["advisory"]},{"url":"https://www.mail-archive.com/user@xstream.codehaus.org/msg00604.html","tags":["web"]},{"url":"https://www.mail-archive.com/user@xstream.codehaus.org/msg00607.html","tags":["web"]},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f554-x222-wgf7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-7285","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0100.html","tags":["advisory"]},{"url":"http://xstream.codehaus.org/security.html","tags":["web","article","report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128807.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12874","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0389","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051277","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0389.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-7285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7285","tags":["advisory","report"]},{"url":"https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2013-7285","tags":["report"]},{"url":"http://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev\u0026page=3","tags":["report"]},{"url":"https://fisheye.codehaus.org/changelog/xstream?cs=2210","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-15T16:54:57Z","modified":"2026-10-08T21:03:14.36Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2019-0463","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-15T16:54:57Z","modified":"2026-10-08T21:03:14Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-f554-x222-wgf7","title":"Command Injection in Xstream","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-29T18:05:03Z","modified":"2024-03-04T23:51:43Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-15T17:29:00.297Z","modified":"2026-10-08T21:17:03.243Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:02:52.545039Z"}],"osv":[{"id":"CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-15T17:29:00Z","modified":"2026-04-16T06:26:00.302432026Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-15T17:29:00.297Z","modified":"2026-10-08T23:47:30.782362064Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"GHSA-f554-x222-wgf7","title":"Command Injection in Xstream","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-29T18:05:03Z","modified":"2024-03-05T00:01:16.285253Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","status":"published","published":"2019-05-15T17:29:00Z","modified":"2025-07-16T07:31:31.891153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"CLSA-2026-1794218779","title":"TuxCare security update for com.thoughtworks.xstream:xstream (1 CVE)","description":"TuxCare rebuilt com.thoughtworks.xstream:xstream to address 1 CVE. Fixed in 1.2.2-tuxcare.3.","status":"published","published":"2026-11-09T11:06:20Z","modified":"2026-11-09T19:15:08.718362131Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"MGASA-2014-0100","title":"Updated xstream packages fix CVE-2013-7285","description":"Updated xstream packages fix security vulnerability:\n\nIt was found that XStream would deserialize arbitrary user-supplied XML\ncontent, representing objects of any type. A remote attacker able to pass XML\nto XStream could use this flaw to perform a variety of attacks, including\nremote code execution in the context of the server running the XStream\napplication (CVE-2013-7285).\n","status":"published","published":"2014-02-25T21:54:53Z","modified":"2026-04-16T06:23:55.279330847Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2014:0389","title":"Red Hat Security Advisory: jasperreports-server-pro security update","status":"published","published":"2024-09-13T08:28:10Z","modified":"2026-06-29T10:06:34Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}