CVE-2019-10173

highpriority · attend · 72EPSS 0.950 · 100 %ileDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

95.0% (100th) EPSS

CVSS 7.5 · high

Is it mine?

88 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.3–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.07.3highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.07.3highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · secalert@redhat.com USexploitability 3.9 · impact 3.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502USCWE-94USCWE-94US

affected products (88)

Products and version ranges known to be affected.

Dell Data Protection Advisor <19.12 SP2all versionscert_bundDE
Dell Data Protection Advisor< 19.12 SP2cert_bundDE
xstream xstream≤ fixed in 1.4.11enisa_euvdEU
Oracle Corp. Banking Platform2.4.0 → 2.10.0fstec_bduRU
Oracle Corp. Communications BRM - Elastic Charging Engine≤ 12.0.0.3.0fstec_bduRU
Oracle Corp. Communications BRM - Elastic Charging Engine≤ 11.3.0.9.0fstec_bduRU
Oracle Corp. Communications Diameter Signaling Router8.0.0 → 8.2.2fstec_bduRU
Oracle Corp. Communications MetaSolv Solution≤ 6.3.1fstec_bduRU
Oracle Corp. Communications MetaSolv Solution≤ 6.3.0fstec_bduRU
Oracle Corp. Financial Services Analytical Applications Infrastructure8.0.6 → 8.1.0fstec_bduRU
Oracle Corp. Financial Services Funds Transfer Pricing≤ 8.1.0fstec_bduRU
Oracle Corp. Financial Services Funds Transfer Pricing≤ 8.0.6fstec_bduRU
Oracle Corp. Financial Services Funds Transfer Pricing≤ 8.0.7fstec_bduRU
Oracle Corp. Financial Services Profitability Management≤ 8.0.7fstec_bduRU
Oracle Corp. Financial Services Profitability Management≤ 8.0.6fstec_bduRU
Oracle Corp. Financial Services Profitability Management≤ 8.1.0fstec_bduRU
Oracle Corp. Fusion Middleware MapViewer≤ 12.2.1.3.0fstec_bduRU
Oracle Corp. Insurance Allocation Manager for Enterprise Profitability≤ 8.1.0fstec_bduRU
Oracle Corp. MySQL Enterprise Monitor≤ 8.0.22fstec_bduRU
Oracle Corp. Oracle Business Activity Monitoring≤ 11.1.1.9.0fstec_bduRU

showing 20 of 88

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1689Dell Data Protection Advisor: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2024-07-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Programmcode auszuführen.
WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
GHSA-hf23-9pf7-388pDeserialization of Untrusted Data and Code Injection in xstream2019-07-26ghsa · osvUS
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2019-07-23modified 2026-06-17

references (53)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan