$ cve CVE-2019-10173 JSON

CVE-2019-10173

9.8

CRITICAL · CVSS 3.1 · EPSS 95% (pctl 100)

Patch early

EPSS 95% — above the 10% action threshold.

Description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	95.04% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	none known
Published	2019-07-23
Last modified	2026-06-17

Affected (10)

Vendor	Product
oracle	banking platform
oracle	business activity monitoring
oracle	communications billing and revenue management elastic charging engine
oracle	communications diameter signaling router
oracle	communications unified inventory management
oracle	endeca information discovery studio
oracle	retail xstore point of service
oracle	utilities framework
oracle	webcenter portal
xstream	xstream

References

→ the Explorer · watch your stack · NVD