{"id":"CVE-2013-7285","url":"https://www.cyber-defence.io/tools/cve/CVE-2013-7285","generatedAt":"2026-11-05T02:58:52.871Z","title":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported…","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","published":"2019-05-15T17:29:00.000Z","lastModified":"2026-10-08T21:17:03.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":["oracle/endeca information discovery studio","apache/activemq","xstream/xstream"],"epss":{"score":0.84362,"percentile":0.99699,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2016-01-07","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":39193,"kind":"exploit","title":"OpenMRS Reporting Module 0.9.7 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/39193","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/39193.txt","file":"exploits/java/webapps/39193.txt","published":"2016-01-07","added":"2016-01-07","updated":"2016-01-07","author":"Brian D. Hysell","type":"webapps","platform":"java","port":null,"verified":false,"codes":["CVE-2013-7285","OSVDB-102253"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 84.4%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["Broken Link","Not Applicable","URL Repurposed"],"source":"cve@mitre.org"},{"url":"http://seclists.org/oss-sec/2014/q1/69","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://x-stream.github.io/CVE-2013-7285.html","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["Broken Link","Not Applicable","URL Repurposed"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/oss-sec/2014/q1/69","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://x-stream.github.io/CVE-2013-7285.html","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-7285","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}