Command Injection in Xstream

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Vulnerability ID: GHSA-f554-x222-wgf7
Aliases: CVE-2013-7285
Published: 2019-05-29 18:05:03
CWE: CWE-77
CWE-78
Severity rating: CRITICAL
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven
name: com.thoughtworks.xstream:xstream
package: ecosystem: Maven
name: com.thoughtworks.xstream:xstream