| Package | Affected versions | Patched versions |
|---|---|---|
| com.thoughtworks.xstream:xstream | ≥ 1.4.10, < 1.4.11 | 1.4.11 |
| banking platform | = 2.4.0= 2.7.1= 2.9.0≥ 2.4.0, ≤ 2.10.0 | |
| business activity monitoring | = 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0 | |
| communications billing and revenue management elastic charging engine | = 11.3.0.9.0= 12.0.0.3.0 | |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.2.2 | |
| communications unified inventory management | = 7.3.0= 7.4.0 | |
| endeca information discovery studio | = 3.2.0= 3.2.0.0 | |
| retail xstore point of service | = 17.0 | |
| utilities framework | = 2.2.0.0.0= 4.2.0.2.0= 4.2.0.3.0= 4.4.0.0.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0 | |
| webcenter portal | = 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0 | |
| xstream | = 1.4.10 |
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free