"value":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON."
}
]
},
"problemtype":{
"problemtype_data":[
{
"description":[
{
"lang":"eng",
"value":"n/a"
}
]
}
]
},
"affects":{
"vendor":{
"vendor_data":[
{
"product":{
"product_data":[
{
"product_name":"n/a",
"version":{
"version_data":[
{
"version_value":"n/a"
}
]
}
}
]
},
"vendor_name":"n/a"
}
]
}
},
"references":{
"reference_data":[
{
"refsource":"MLIST",
"name":"[oss-security] 20140109 Re: CVE request: remote code execution via deserialization in XStream",
"url":"http://seclists.org/oss-sec/2014/q1/69"
},
{
"refsource":"MLIST",
"name":"[xstream-user] 20130717 Re: Is it possible to unregister the DynamicProxyConverter using the SpringOXM wrapper",
