CVE-2013-7285

Name: CVE-2013-7285
Creator: NVD / NIST
Published: 2019-05-15T17:29:00.297+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 84.36%

Last modified Jun 17, 2026

CVE-2013-7285 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. EPSS estimates a 84.36% chance of exploitation in the next 30 days.

Description

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

84.36%

99.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Oracle	Endeca Information Discovery Studio	3.2.0
Apache	Activemq	5.15.8
Xstream	Xstream	<= 1.4.6
Xstream	Xstream	1.4.10

References

http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlBroken Link, Not Applicable, URL Repurposed
http://seclists.org/oss-sec/2014/q1/69Mailing List, Third Party Advisory
http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlThird Party Advisory
https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3EMailing List
https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3EMailing List
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlThird Party Advisory
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://x-stream.github.io/CVE-2013-7285.htmlExploit, Third Party Advisory
http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlBroken Link, Not Applicable, URL Repurposed
http://seclists.org/oss-sec/2014/q1/69Mailing List, Third Party Advisory
http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlThird Party Advisory
https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3EMailing List
https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3EMailing List
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlThird Party Advisory
https://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://x-stream.github.io/CVE-2013-7285.htmlExploit, Third Party Advisory

Timeline

Published: May 15, 2019
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2013-7285?

How severe is CVE-2013-7285?

CVE-2013-7285 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 84.36% probability of exploitation in the next 30 days.

How do I fix CVE-2013-7285?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-7285?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST