CVE-2019-10173 (banking_platform, business_activity_monitoring, communications_billing_and_revenue_management_elastic_charging_engine, communications_diameter_signaling_router, communications_unified_inventory_management, endeca_information_discovery_studio, retail_xstore_point_of_service, utilities_framework, webcenter_portal, xstream)

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

View Full Alert

Leave a Reply