High severity · published Nov 16, 2020
CVE-2020-26217
Remote Code Execution in XStream
8.8
CVSS
82.7%
EPSS
No
On KEV
Description
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)82.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
ActiveMQ · Apache
before 5.15.14; 5.16.0 · source: NVD
XS
xstream · x-stream
< 1.4.14 · source: vendor, NVD
BC
Banking Cash Management · Oracle
14.2; 14.3; 14.5 · source: NVD
BC
Banking Corporate Lending Process Management · Oracle
14.2; 14.3; 14.5 · source: NVD
BC
Banking Credit Facilities Process Management · Oracle
14.2; 14.3; 14.5 · source: NVD
BP
Banking Platform · Oracle
2.4.0; 2.7.1; 2.9.0 · source: NVD
BS
Banking Supply Chain Finance · Oracle
14.2; 14.3; 14.5 · source: NVD
BT
Banking Trade Finance Process Management · Oracle
14.2; 14.3; 14.5 · source: NVD
BV
Banking Virtual Account Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BA
Business Activity Monitoring · Oracle
11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 · source: NVD
CP
Communications Policy Management · Oracle
12.5.0 · source: NVD
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26217
x_refsource_CONFIRM
https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
x_refsource_CONFIRM
https://x-stream.github.io/CVE-2020-26217.html
x_refsource_CONFIRM
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
mailing-list
https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html
vendor-advisory
https://www.debian.org/security/2020/dsa-4811
mailing-list
https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E
More from ActiveMQ
9.8
CVE-2023-46604
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
9.8
CVE-2016-3088
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
8.8
CVE-2026-34197
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
9.9
CVE-2021-21345
XStream is vulnerable to a Remote Command Execution attack
9.8
CVE-2021-21350
XStream is vulnerable to an Arbitrary Code Execution attack