Kritik CVSS 9.8 PoC var
CVE-2013-7285: Endeca Information Discovery Studio: işletim sistemi komut enjeksiyonu
Açıklama (NVD)
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Özet bilgiler
- Ürün
- Oracle Endeca Information Discovery Studio
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %84,36 (yüzdelik 100)
- CWE
- CWE-78
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| oracle-endeca-information-discovery-studio | 3.2.0 | 3.2.0 | — |
| apache-activemq | 5.15.8 | 5.15.8 | — |
| xstream-xstream | — | 1.4.6 | — |
| xstream-xstream | 1.4.10 | 1.4.10 | — |
Kaynaklar
- NVD kaydı
- blog.diniscruz.com
- seclists.org
- web.archive.org
- lists.apache.org
- lists.apache.org
- www.mail-archive.com
- www.mail-archive.com
- www.oracle.com
- x-stream.github.io
- blog.diniscruz.com
- seclists.org
- web.archive.org
- lists.apache.org
- lists.apache.org
- www.mail-archive.com
- www.mail-archive.com
- www.oracle.com
- x-stream.github.io
- CWE-78