CVE-2013-7285
XStream: remote code execution due to insecure XML deserialization
Severity
ImportantRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · December 22, 2013
Updated · November 2, 2026
Description
It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-94 · Improper Control of Generation of Code