{"id":"CVE-2019-10173","published":"2019-07-23T12:50:44Z","modified":"2024-08-04T22:10:10Z","title":"It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw","vendor":"xstream","product":"xstream","tier":"core","eol":null,"affectedVersions":[{"vendor":"xstream","product":"xstream","versions":["fixed in 1.4.11"]}],"description":{"text":"It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","provenance":"source","from":"CVE.org"},"summary":{"text":"A regression in the XStream library (product: XStream, the XML/JSON serialization API) introduced in version 1.4.10 and fixed in 1.4.11 reopens a previous deserialization flaw. When the security framework has not been initialized, a remote attacker can run arbitrary shell commands by supplying crafted XML or other supported formats such as JSON for unmarshalling, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:39Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.95036,"percentile":0.99861,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4352","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0445","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0727","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173","tags":["x_refsource_CONFIRM"]},{"url":"http://x-stream.github.io/changes.html#1.4.11","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":[">=1.4.10, <1.4.11"],"patched":["1.4.11"],"from":["GHSA-hf23-9pf7-388p"],"provenance":"source"}],"advisories":[{"id":"GHSA-hf23-9pf7-388p","url":"https://github.com/advisories/GHSA-hf23-9pf7-388p","severity":"CRITICAL","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":[">=1.4.10, <1.4.11"],"patched":["1.4.11"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2019-0591","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0591","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-07-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-10173","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-x-stream-xstream-cve-2017-7957","parents":[{"from":"CVE-2013-7285","to":"CVE-2019-10173","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","from":"CVE.org","in":"CVE-2019-10173"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2016-3674","published":"2016-05-17","fixed":"1.4.9","kev":false},{"cve":"CVE-2017-7957","published":"2017-04-29","fixed":"1.4.10","kev":false},{"cve":"CVE-2013-7285","published":"2019-05-15","fixed":"1.4.11","kev":false},{"cve":"CVE-2019-10173","published":"2019-07-23","fixed":"1.4.11","kev":false},{"cve":"CVE-2020-26217","published":"2020-11-16","fixed":"1.4.14-java7","kev":false,"link":{"from":"CVE-2019-10173","to":"CVE-2020-26217","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.thoughtworks.xstream:xstream","fromFixed":"1.4.11","toFixed":"1.4.14-java7","daysApart":482}]}},{"cve":"CVE-2020-26258","published":"2020-12-16","fixed":"1.4.15","kev":false},{"cve":"CVE-2020-26259","published":"2020-12-16","fixed":"1.4.15","kev":false}],"package":"Maven:com.thoughtworks.xstream:xstream"}}