VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 23, 2019· Updated Jun 17, 2026

CVE-2019-10173

CVE-2019-10173

Description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.thoughtworks.xstream:xstreamMaven
>= 1.4.10, < 1.4.111.4.11

Affected products

28
  • Oracle Corporation/Banking Platform4 versions
    cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*range: >=2.4.0,<=2.10.0
    • cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
  • Oracle Corporation/Business Activity Monitoring3 versions
    cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Billing And Revenue Management Elastic Charging Engine2 versions
    cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Diameter Signaling Router
    cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
    Range: >=8.0.0,<=8.2.2
  • Oracle Corporation/Communications Unified Inventory Management2 versions
    cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
  • Oracle Corporation/Endeca Information Discovery Studio2 versions
    cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*
  • Oracle Corporation/Retail Xstore Point Of Service
    cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
  • Oracle Corporation/Utilities Framework5 versions
    cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*range: >=4.3.0.1.0,<=4.3.0.6.0
    • cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
  • Oracle Corporation/Webcenter Portal3 versions
    cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
  • Xstream/Xstream2 versions
    cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:*
    • (no CPE)range: fixed in 1.4.11
  • osv-coords3 versions
    pkg:apk/chainguard/hadoop-fips-3.3.6pkg:apk/chainguard/hadoop-fips-3.4.2pkg:maven/com.thoughtworks.xstream/xstream
    < 3.3.6-r21+ 2 more
    • (no CPE)range: < 3.3.6-r21
    • (no CPE)range: < 3.4.2-r0
    • (no CPE)range: >= 1.4.10, < 1.4.11

Patches

Vulnerability mechanics

References

13

News mentions

0

No linked articles in our index yet.