Vulnerabilities > CVE-2019-10173

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

xstream-project

oracle

critical

NVD

Published: 2019-07-23

Updated: 2024-11-21

Summary

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Vulnerable Configurations

Part	Description	Count
Application	Xstream_Project Xstream Project Xstream 1.4.10	1
Application	Oracle Oracle Banking Platform 2.4.0 Oracle Banking Platform 2.9.0 Oracle Banking Platform 2.7.1 Oracle Banking Platform 2.4.1 Oracle Banking Platform 2.5.0 Oracle Banking Platform 2.6.0 Oracle Banking Platform 2.6.1 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.7.0 Oracle Banking Platform 2.8.0 Oracle Banking Platform 2.10.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Webcenter Portal 12.2.1.4.0 Oracle Utilities Framework 4.2.0.3.0 Oracle Utilities Framework 4.2.0.2.0 Oracle Utilities Framework 2.2.0.0.0 Oracle Utilities Framework 4.3.0.1.0 Oracle Utilities Framework 4.3.0.2.0 Oracle Utilities Framework 4.3.0.3.0 Oracle Utilities Framework 4.3.0.4 Oracle Utilities Framework 4.3.0.4.0 Oracle Utilities Framework 4.3.0.5.0 Oracle Utilities Framework 4.3.0.6.0 Oracle Utilities Framework 4.4.0.0.0 Oracle Communications Billing AND Revenue Management Elastic Charging Engine 11.3.0.9.0 Oracle Communications Billing AND Revenue Management Elastic Charging Engine 12.0.0.3.0 Oracle Communications Unified Inventory Management 7.3.0 Oracle Communications Unified Inventory Management 7.4.0 Oracle Communications Diameter Signaling Router 8.0.0 Oracle Communications Diameter Signaling Router 8.0.0.0 Oracle Communications Diameter Signaling Router 8.1 Oracle Communications Diameter Signaling Router 8.2 Oracle Communications Diameter Signaling Router 8.2.1 Oracle Communications Diameter Signaling Router 8.2.2 Oracle Retail Xstore Point OF Service 17.0 Oracle Endeca Information Discovery Studio 3.2.0 Oracle Endeca Information Discovery Studio 3.2.0.0 Oracle Business Activity Monitoring 12.2.1.4.0 Oracle Business Activity Monitoring 11.1.1.9.0 Oracle Business Activity Monitoring 12.2.1.3.0	41

Redhat

advisories

rhsa
id RHSA-2019:3892
rhsa
id RHSA-2019:4352
rhsa
id RHSA-2020:0445
rhsa
id RHSA-2020:0727

Vulnerabilities > CVE-2019-10173 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2019-10173"}]}

Summary

Vulnerable Configurations

Redhat

References

Vulnerabilities > CVE-2019-10173