9.3

CVE-2020-26217

Exploit

Remote Code Execution in XStream

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xstream ≫ Xstream Version < 1.4.14
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Netapp ≫ Snapmanager SwPlatform sap
Netapp ≫ Snapmanager Version - Update - SwPlatform oracle
Apache ≫ Activemq Version < 5.15.14
Apache ≫ Activemq Version 5.16.0
Oracle ≫ Banking Cash Management Version 14.2
Oracle ≫ Banking Cash Management Version 14.3
Oracle ≫ Banking Cash Management Version 14.5
Oracle ≫ Banking Platform Version 2.4.0
Oracle ≫ Banking Platform Version 2.7.1
Oracle ≫ Banking Platform Version 2.9.0
Oracle ≫ Business Activity Monitoring Version 11.1.1.9.0
Oracle ≫ Business Activity Monitoring Version 12.2.1.3.0
Oracle ≫ Business Activity Monitoring Version 12.2.1.4.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 85% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
security-advisories@github.com 8 1.3 6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.oracle.com/security-alerts/cpuapr2022.html
Third Party Advisory
Not Applicable
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory
Not Applicable
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2021.html
Patch
Third Party Advisory
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20210409-0004/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4811
Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
Third Party Advisory
Mitigation
https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E
Mailing List
Issue Tracking
https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E
Mailing List
Issue Tracking
https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E
Mailing List
Issue Tracking
https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E
Mailing List
Issue Tracking
https://x-stream.github.io/CVE-2020-26217.html
Vendor Advisory
Exploit
Mitigation