CVE-2013-7285: apache activemq OS Command Injection
Vulnerability summary
CVE-2013-7285 is a critical (CVSS 9.8) OS Command Injection vulnerability in apache activemq. EPSS estimates a 84.36% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 15-05-2019PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
84.36%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 84.36% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (x-stream.github.io)
Maturity: unknown
OpenMRS Reporting Module 0.9.7 - Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Mageia3 products
- xstream< 1.3.1-6.1.mga3
- kxml< 2.3.0-5.1.mga4
- xstream< 1.4.7-1.mga4
Apache1 product
- activemqEOL5.15.8
Com.thoughtworks.xstream1 product
- xstream< 1.4.7 | ≥ 1.4.10, < 1.4.11
Debian1 product
- libxstream-java< 1.4.7-1
Oracle1 product
Redhat1 product
- jasperreports-server-pro< 0:5.5.0-6.el6ev
Ubuntu1 product
- libxstream-java< 1.4.7-1
Xstream1 product
- xstream≤ 1.4.6 | 1.4.10
8 vendors · 10 products
References
30 links- www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlMailing ListX Refsource MLISTThird Party Advisory
- www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlMailing ListX Refsource MLISTThird Party Advisory
- blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlX Refsource MISCBroken LinkNot ApplicableURL RepurposedARTICLEREPORTWEB
