CVE-2013-7285 in API
Summary
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Reservation
01/09/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 135058 | Xstream API Security command injection | 77 | Proof-of-Concept | Official fix | CVE-2013-7285 |