CVE-2019-10173

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 95.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-23 · updated 2026-06-17
Weakness: CWE-94

Description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Affected products

Oracle Banking Platform: from 2.4.0 through 2.10.0; 2.4.0, 2.7.1, 2.9.0
Oracle Business Activity Monitoring: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle Communications BRM - Elastic Charging Engine: 11.3.0.9.0, 12.0.0.3.0
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.0, 7.4.0
Oracle Endeca Information Discovery Studio: 3.2.0, 3.2.0.0
Oracle Corporation Retail Xstore Point of Service: 17.0
Oracle Corporation Utilities Framework: from 4.3.0.1.0 through 4.3.0.6.0; 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0
Oracle Corporation Oracle WebCenter Portal: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
x-stream xstream: 1.4.10

References

Get alerted when CVE-2019-10173 or the next vulnerability affects your stack