Tracker / CVE-2020-26217
CVE-2020-26217
High 8.0
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Affected products and versions
| apache | activemq |
|---|---|
| apache | activemq · … → 5.15.14 |
| debian | debian_linux |
| netapp | snapmanager |
| oracle | banking_cash_management |
| oracle | banking_corporate_lending_process_management |
| oracle | banking_credit_facilities_process_management |
| oracle | banking_platform |
| oracle | banking_supply_chain_finance |
| oracle | banking_trade_finance_process_management |
| oracle | banking_virtual_account_management |
| oracle | business_activity_monitoring |
| oracle | communications_policy_management |
| oracle | endeca_information_discovery_studio |
| oracle | retail_xstore_point_of_service |
| xstream | xstream · … → 1.4.14 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.