Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not…
Priority CRITICAL 90CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 15 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.84362 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.thoughtworks.xstream:xstream (Maven): 1.4.7, 1.4.11Red Hat: 12 advisoriesRed Hat: 15 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.7 | 1.4.7 | Patch available | GHSA-f554-x222-wgf7 |
| — | com.thoughtworks.xstream:xstream (Maven) | 1.4.10 to before 1.4.11 | 1.4.11 | Patch available | GHSA-f554-x222-wgf7 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.7 Fixed in 1.4.7 Patch available GHSA-f554-x222-wgf7
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected 1.4.10 to before 1.4.11 Fixed in 1.4.11 Patch available GHSA-f554-x222-wgf7
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:apache:activemq:5.15.8:*:*:*:*:*:*:* | 5.15.8 | Vulnerable | Apache |
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | up to 1.4.6 | Vulnerable | XStream |
| cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:* | 1.4.10 | Vulnerable | XStream |
- cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
- cpe:2.3:a:apache:activemq:5.15.8:*:*:*:*:*:*:* Versions 5.15.8 Vulnerable ·Apache
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions up to 1.4.6 Vulnerable ·XStream
- cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·XStream
Remediation
- Fix · GHSA-f554-x222-wgf7 com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.7 Advisory →
- Fix · GHSA-f554-x222-wgf7 com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.11 Advisory →
Red Hat 12 advisories
- RHSA-2015:1888 Released 2015-10-12 · Red Hat rating ImportantRed Hat JBoss SOA Platform 5.3.1 security update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2015:1009 Released 2015-05-14 · Red Hat rating ImportantRed Hat JBoss Portal 6.2.0 update
- Red Hat JBoss Portal 6.2
- RHSA-2014:1059 Released 2014-08-14 · Red Hat rating ImportantJBoss Enterprise Portal Platform 5.2.2 security update
- Red Hat JBoss Portal 5.2
Show 9 more Red Hat advisories
- RHSA-2014:1007 Released 2014-08-05 · Red Hat rating ImportantRed Hat JBoss BRMS 5.3.1 update
- JBoss Enterprise BRMS Platform 5.3
- RHSA-2014:0452 Released 2014-04-30 · Red Hat rating ImportantFuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
- Fuse ESB Enterprise 7.1.0
- Fuse MQ Enterprise 7.1.0
- Fuse Management Console 7.1.0
- RHSA-2014:0389 Released 2014-04-09 · Red Hat rating Importantjasperreports-server-pro security update
- RHEV-M 3.3 jasperreports-server-pro-5.5.0-6.el6ev
- RHSA-2014:0374 Released 2014-04-03 · Red Hat rating ImportantRed Hat JBoss Data Grid 6.2.1 update
- Red Hat JBoss Data Grid 6.2
- RHSA-2014:0372 Released 2014-04-03 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.1 update
- Red Hat JBoss BRMS 6.0
- RHSA-2014:0371 Released 2014-04-03 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.1 update
- Red Hat JBoss BPMS 6.0
- RHSA-2014:0323 Released 2014-03-24 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.0.0 security update
- Red Hat JBoss A-MQ 6.0
- Red Hat JBoss Fuse 6.0
- RHSA-2014:0294 Released 2014-03-13 · Red Hat rating ImportantXStream security update
- Red Hat JBoss Data Virtualization 6.0
- RHSA-2014:0216 Released 2014-02-26 · Red Hat rating ImportantXStream security update
- Red Hat JBoss Fuse Service Works 6.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2014:0452 |
| Fuse MQ Enterprise 7.1.0 | Fixed | RHSA-2014:0452 |
| Fuse Management Console 7.1.0 | Fixed | RHSA-2014:0452 |
| JBoss Enterprise BRMS Platform 5.3 | Fixed | RHSA-2014:1007 |
| RHEV-M 3.3 | Fixed | RHSA-2014:0389 |
| Red Hat JBoss A-MQ 6.0 | Fixed | RHSA-2014:0323 |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2014:0371 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2014:0372 |
| Red Hat JBoss Data Grid 6.2 | Fixed | RHSA-2014:0374 |
| Red Hat JBoss Data Virtualization 6.0 | Fixed | RHSA-2014:0294 |
| Red Hat JBoss Fuse 6.0 | Fixed | RHSA-2014:0323 |
| Red Hat JBoss Fuse Service Works 6.0 | Fixed | RHSA-2014:0216 |
| Red Hat JBoss Portal 5.2 | Fixed | RHSA-2014:1059 |
| Red Hat JBoss Portal 6.2 | Fixed | RHSA-2015:1009 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2015:1888 |
Not affected: 1 product
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2013-7285
- 2026-10-03 Alias added: GHSA-f554-x222-wgf7
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-09 Priority changed: HIGH → CRITICAL
References
Advisory 6
- [oss-security] 20140109 Re: CVE request: remote code execution via deserialization in XStream
- [xstream-user] 20130717 Re: Is it possible to unregister the DynamicProxyConverter using the SpringOXM wrapper
- [xstream-user] 20130718 Re: Is it possible to unregister the DynamicProxyConverter using the SpringOXM wrapper
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
- https://nvd.nist.gov/vuln/detail/CVE-2013-7285
Other 8
- [activemq-issues] 20190718 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar
- [activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries.
- http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
- https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
- https://www.mail-archive.com/[email protected]/msg00604.html
- https://www.mail-archive.com/[email protected]/msg00607.html
Sources
- CVE-2013-7285 · CVE Program
- CVE-2013-7285 · NVD
- FIRST EPSS
- GHSA-f554-x222-wgf7 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-7285 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences