CVEvulnerability

CVE-2020-26217

8.8 HIGH Published 2020-11-16 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2020-11-16
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-78

Description

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Affected configurations

• xstream xstream (< 1.4.14) • debian debian linux 9.0 • debian debian linux 10.0 • netapp snapmanager • apache activemq (< 5.15.14) • apache activemq 5.16.0 • oracle banking cash management 14.2 • oracle banking cash management 14.3 • oracle banking cash management 14.5 • oracle banking corporate lending process management 14.2 • oracle banking corporate lending process management 14.3 • oracle banking corporate lending process management 14.5 • oracle banking credit facilities process management 14.2 • oracle banking credit facilities process management 14.3 • oracle banking credit facilities process management 14.5 • oracle banking platform 2.4.0 • oracle banking platform 2.7.1 • oracle banking platform 2.9.0 • oracle banking supply chain finance 14.2 • oracle banking supply chain finance 14.3 • oracle banking supply chain finance 14.5 • oracle banking trade finance process management 14.2 • oracle banking trade finance process management 14.3 • oracle banking trade finance process management 14.5 • oracle banking virtual account management 14.2.0 • oracle banking virtual account management 14.3.0 • oracle banking virtual account management 14.5.0 • oracle business activity monitoring 11.1.1.9.0 • oracle business activity monitoring 12.2.1.3.0 • oracle business activity monitoring 12.2.1.4.0 • oracle communications policy management 12.5.0 • oracle endeca information discovery studio 3.2.0.0 • oracle retail xstore point of service 16.0.6 • oracle retail xstore point of service 17.0.4 • oracle retail xstore point of service 18.0.3 • oracle retail xstore point of service 19.0.2

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References