CVE-2019-10173

Published: Jul 23, 2019Modified: May 14, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Affected (24)

Products: Xstream: Xstream · Oracle: Banking Platform, Business Activity Monitoring, Communications Billing And Revenue Management Elastic Charging Engine, Communications Diameter Signaling Router, Communications Unified Inventory Management, Endeca Information Discovery Studio, Retail Xstore Point Of Service, Utilities Framework, Webcenter Portal

1 product

9 products

Business Activity Monitoring

Communications Billing And Revenue Management Elastic Charging Engine

Communications Diameter Signaling Router

Communications Unified Inventory Management

Endeca Information Discovery Studio

Retail Xstore Point Of Service

Utilities Framework

Webcenter Portal

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xstream Xstream	Version 1.4.10

Configuration B

23 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	From 2.4.0 to 2.10.0
Oracle Banking Platform	Version 2.4.0
Oracle Banking Platform	Version 2.7.1
Oracle Banking Platform	Version 2.9.0
Oracle Business Activity Monitoring	Version 11.1.1.9.0
Oracle Business Activity Monitoring	Version 12.2.1.3.0
Oracle Business Activity Monitoring	Version 12.2.1.4.0
Oracle Communications Billing And Revenue Management Elastic Charging Engine	Version 11.3.0.9.0
Oracle Communications Billing And Revenue Management Elastic Charging Engine	Version 12.0.0.3.0
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Unified Inventory Management	Version 7.3.0
Oracle Communications Unified Inventory Management	Version 7.4.0
Oracle Endeca Information Discovery Studio	Version 3.2.0.0
Oracle Endeca Information Discovery Studio	Version 3.2.0
Oracle Retail Xstore Point Of Service	Version 17.0
Oracle Utilities Framework	From 4.3.0.1.0 to 4.3.0.6.0
Oracle Utilities Framework	Version 2.2.0.0.0
Oracle Utilities Framework	Version 4.2.0.2.0
Oracle Utilities Framework	Version 4.2.0.3.0
Oracle Utilities Framework	Version 4.4.0.0.0
Oracle Webcenter Portal	Version 11.1.1.9.0
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0