{"id":"CVE-2013-7285","revision":"65a816b03b53405485b2189d69530986","records":[{"revision":"65a816b03b53405485b2189d69530986","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2013-7285","aliases":[],"title":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any sup…","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","state":0,"publishedAt":"2019-05-15T16:54:57+00:00","modifiedAt":"2026-10-08T21:03:14.36+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"n/a\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"n/a\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["http://seclists.org/oss-sec/2014/q1/69","https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html","https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html","https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","https://x-stream.github.io/CVE-2013-7285.html","https://www.oracle.com/security-alerts/cpuoct2020.html","http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2013-7285","license":"CVE Program Terms of Use","key":"cve-program:CVE-2013-7285","identifiers":["CVE-2013-7285"]},"retained":false,"historicalAffected":[]}],"coverage":[]}