CVE-2020-26217
High
Description
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
SeverityHigh
CVSS8.0
Exploit probability—
Product
Xstream
PublishedNov 16, 2020
First seenNov 16, 2020
Weakness typeCWE-78OS command injection
How to fix
Update
- xstream xstream1.4.14 or later
- apache activemq5.15.14 or later
- com.thoughtworks.xstream:xstream1.4.14-java7 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xstream xstream | v < 1.4.14 | 1.4.14 |
| debian debian_linux | 9.0, 10.0 | — |
| netapp snapmanager | No range specified | — |
| apache activemq | v < 5.15.14, 5.16.0 | 5.15.14 |
| oracle banking_cash_management | 14.2, 14.3, 14.5 | — |
| oracle banking_corporate_lending_process_management | 14.2, 14.3, 14.5 | — |
| oracle banking_credit_facilities_process_management | 14.2, 14.3, 14.5 | — |
| oracle banking_platform | 2.4.0, 2.7.1, 2.9.0 | — |
| oracle banking_supply_chain_finance | 14.2, 14.3, 14.5 | — |
| oracle banking_trade_finance_process_management | 14.2, 14.3, 14.5 | — |
| oracle banking_virtual_account_management | 14.2.0, 14.3.0, 14.5.0 | — |
| oracle business_activity_monitoring | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_policy_management | 12.5.0 | — |
| oracle endeca_information_discovery_studio | 3.2.0.0 | — |
| oracle retail_xstore_point_of_service | 16.0.6, 17.0.4, 18.0.3, 19.0.2 | — |
| com.thoughtworks.xstream:xstreamMaven | v < 1.4.14-java7 | 1.4.14-java7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.