CVE-2013-7285
CriticalPublic exploitCommand Injection in Xstream
Published May 29, 2019 · Updated Oct 8, 2026 · Also known as DEBIAN-CVE-2013-7285, GHSA-f554-x222-wgf7, UBUNTU-CVE-2013-7285
Key Facts
Patch immediately- CVE-2013-7285 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Activemq (Apache), Endeca Information Discovery Studio (Oracle), Xstream and 3 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 84% probability of exploitation in the next 30 days.
- Fixed versions are available, including com.thoughtworks.xstream:xstream 1.4.11, com.thoughtworks.xstream:xstream 1.4.7, jasperreports-server-pro 0:5.5.0-6.el6ev.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
84%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2013-7285 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Affected Products
19 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ActivemqApache | 5.15.8 | n/a |
| Endeca Information Discovery StudioOracle | 3.2.0 | n/a |
| XstreamXstream | 1.4.10 | 1.4.6 |
| libxstream-javadebian | See advisory | 1.4.7-1 |
| com.thoughtworks.xstream:xstreammaven | See advisory | 1.4.11 |
Patched Releases
com.thoughtworks.xstream:xstream
1.4.11, 1.4.7
jasperreports-server-pro
0:5.5.0-6.el6ev
libxstream-java
1.4.7-1
Xstream
<=1.4.6
Timeline
Publicly disclosed
May 29, 2019
Last updated
Oct 8, 2026
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryhttp://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev&page=3
- advisoryRHSA-2014:0216
- advisoryRHSA-2014:0294
- advisoryRHSA-2014:0323
- advisoryRHSA-2014:0371
FAQ
Common Questions.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format.
Affected: Activemq (Apache) versions 5.15.8; Endeca Information Discovery Studio (Oracle) versions 3.2.0; Xstream versions 1.4.10, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including com.thoughtworks.xstream:xstream 1.4.11, com.thoughtworks.xstream:xstream 1.4.7, jasperreports-server-pro 0:5.5.0-6.el6ev.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2013-7285 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo