Read the docs
TI-2019-07494 Aliases CVE-2019-10173GHSA-hf23-9pf7-388p

Code injection in xstream

Priority CRITICAL 86CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Why it matters now

EPSS 0.95036 99th percentileScored 2026-11-07
Fix Fixed com.thoughtworks.xstream:xstream (Maven): 1.4.11Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
XStreamxstreamfixed in 1.4.11—No fix listedCNA
—com.thoughtworks.xstream:xstream (Maven)1.4.10 to before 1.4.111.4.11Patch availableGHSA-hf23-9pf7-388p
  • xstream VendorXStream Affected fixed in 1.4.11 Fixed in — No fix listed CNA
  • com.thoughtworks.xstream:xstream (Maven) Vendor— Affected 1.4.10 to before 1.4.11 Fixed in 1.4.11 Patch available GHSA-hf23-9pf7-388p

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:*1.4.10VulnerableXStream
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*2.4.0 – 2.10.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableOracle
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*11.3.0.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
  • cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·XStream
  • cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* Versions 2.4.0 – 2.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:* Versions 11.3.0.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0 – 8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*3.2.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*4.3.0.1.0 – 4.3.0.6.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:*:*:*:*:*:*:*2.2.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*4.2.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*4.2.0.3.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.1.0 – 4.3.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:*:*:*:*:*:*:* Versions 2.2.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-hf23-9pf7-388p com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.11 Advisory →

Red Hat 6 advisories

  • RHSA-2020:0727 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.3 security update
    • Red Hat Data Grid 7.3.3
  • RHSA-2020:0445 Released 2020-02-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.6 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2019:4352 Released 2019-12-19 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R14 security and bug fix update
    • Red Hat Fuse 6.3
Show 3 more Red Hat advisories
  • RHSA-2019:3892 Released 2019-11-14 · Red Hat rating Important
    Red Hat Fuse 7.5.0 security update
    • Red Hat Fuse 7.5.0
  • RHSA-2019:1822 Released 2019-07-22 · Red Hat rating Important
    Red Hat Decision Manager 7.4.0 Security Update
    • Red Hat JBoss BRMS 7.4
  • RHSA-2019:1823 Released 2019-07-22 · Red Hat rating Important
    Red Hat Process Automation Manager 7.4.0 Security Update
    • Red Hat JBoss BPMS 7.4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Data Grid 7.3.3Fixed RHSA-2020:0727
Red Hat Fuse 6.3Fixed RHSA-2019:4352
Red Hat Fuse 7.5.0Fixed RHSA-2019:3892
Red Hat JBoss BPMS 7.4Fixed RHSA-2019:1823
Red Hat JBoss BRMS 7.4Fixed RHSA-2019:1822
Red Hat Single Sign-On 7.3Fixed RHSA-2020:0445

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10173
  2. 2026-10-03 Alias added: GHSA-hf23-9pf7-388p

References

Patch 2

Advisory 10

Other 1

  • TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
  • TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
  • TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
  • TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
  • TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
  • TI-2020-16038 Remote Code Execution in XStream CVSS 3.1HIGH 8.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences