Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2019-10173 Details
Description
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xstream xstream | 1.4.10 |
CPE
Remediation
| |
| oracle banking platform | >= 2.4.0, <= 2.10.0 2.4.0 2.7.1 2.9.0 |
CPE
Remediation
| |
| oracle business activity monitoring | 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 |
CPE
Remediation
| |
| oracle communications billing and revenue management elastic charging engine | 11.3.0.9.0 12.0.0.3.0 |
CPE
Remediation
| |
| oracle communications diameter signaling router | >= 8.0.0, <= 8.2.2 |
CPE
Remediation
| |
| oracle communications unified inventory management | 7.3.0 7.4.0 |
CPE
Remediation
| |
| oracle endeca information discovery studio | 3.2.0 3.2.0.0 |
CPE
Remediation
| |
| oracle retail xstore point of service | 17.0 |
CPE
Remediation
| |
| oracle utilities framework | >= 4.3.0.1.0, <= 4.3.0.6.0 2.2.0.0.0 4.2.0.2.0 4.2.0.3.0 4.4.0.0.0 |
CPE
Remediation
| |
| oracle webcenter portal | 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 |
CPE
Remediation
| |
Change History
18 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2025 | CPE Deprecation Remap | [email protected] |
| Apr 1, 2025 | CPE Deprecation Remap | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Oct 5, 2022 | Modified Analysis | [email protected] |
| Jul 20, 2021 | CVE Modified | [email protected] |
| Jun 14, 2021 | CVE Modified | [email protected] |
| Mar 16, 2021 | Modified Analysis | [email protected] |
| Jan 20, 2021 | CVE Modified | [email protected] |
| Oct 20, 2020 | CVE Modified | [email protected] |
| Apr 15, 2020 | CVE Modified | [email protected] |
| Mar 11, 2020 | CVE Modified | [email protected] |
| Feb 6, 2020 | CVE Modified | [email protected] |
| Dec 19, 2019 | CVE Modified | [email protected] |
| Nov 15, 2019 | CVE Modified | [email protected] |
| Oct 9, 2019 | CVE Modified | [email protected] |
| Aug 5, 2019 | Initial Analysis | [email protected] |