CVE-2020-26217

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-26217
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a Patch Third Party Advisory
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a Patch Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 Mitigation Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 Mitigation Third Party Advisory
https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E Issue Tracking Mailing List
https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20210409-0004/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20210409-0004/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4811 Third Party Advisory
https://www.debian.org/security/2020/dsa-4811 Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Not Applicable Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Not Applicable Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Not Applicable Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Not Applicable Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
https://x-stream.github.io/CVE-2020-26217.html Exploit Mitigation Vendor Advisory
https://x-stream.github.io/CVE-2020-26217.html Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*
cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*

Configuration 4 (hide)

OR cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*
History

23 May 2025, 16:54

Type Values Removed Values Added
References (CONFIRM) https://x-stream.github.io/CVE-2020-26217.html - Exploit, Mitigation, Vendor Advisory () https://x-stream.github.io/CVE-2020-26217.html - Exploit, Mitigation, Vendor Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html - Mailing List, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpujan2022.html - Not Applicable, Third Party Advisory () https://www.oracle.com/security-alerts/cpujan2022.html - Not Applicable, Third Party Advisory
References () https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E - () https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E - Issue Tracking, Mailing List
References (DEBIAN) https://www.debian.org/security/2020/dsa-4811 - Third Party Advisory () https://www.debian.org/security/2020/dsa-4811 - Third Party Advisory
References (CONFIRM) https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a - Patch, Third Party Advisory () https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a - Patch, Third Party Advisory
References () https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E - () https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E - Issue Tracking, Mailing List
References () https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E - () https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E - Issue Tracking, Mailing List
References (CONFIRM) https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 - Mitigation, Third Party Advisory () https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 - Mitigation, Third Party Advisory
References () https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E - () https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E - Issue Tracking, Mailing List
References (MISC) https://www.oracle.com/security-alerts/cpuoct2021.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpuoct2021.html - Patch, Third Party Advisory
References (N/A) https://www.oracle.com//security-alerts/cpujul2021.html - Patch, Third Party Advisory () https://www.oracle.com//security-alerts/cpujul2021.html - Patch, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Not Applicable, Third Party Advisory () https://www.oracle.com/security-alerts/cpuapr2022.html - Not Applicable, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20210409-0004/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20210409-0004/ - Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory
First Time Xstream
Xstream xstream
CPE cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:5.15.4:*:*:*:*:*:*:*		 cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

07 Nov 2023, 03:20

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e@%3Cissues.activemq.apache.org%3E', 'name': '[activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c@%3Cissues.activemq.apache.org%3E', 'name': '[activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3@%3Cissues.activemq.apache.org%3E', 'name': '[activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9@%3Ccommits.camel.apache.org%3E', 'name': '[camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217', 'tags': ['Mailing List', 'Patch', 'Third Party Advisory'], 'refsource': 'MLIST'}
  • () https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E -
  • () https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E -
  • () https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E -
  • () https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E -
Information

Published : 2020-11-16 21:15

Updated : 2025-05-23 16:54

NVD link : CVE-2020-26217

Mitre link : CVE-2020-26217

JSON object : View

Products Affected

debian

  • debian_linux

netapp

  • snapmanager

apache

  • activemq

oracle

  • banking_credit_facilities_process_management
  • communications_policy_management
  • banking_corporate_lending_process_management
  • banking_cash_management
  • business_activity_monitoring
  • banking_supply_chain_finance
  • banking_trade_finance_process_management
  • endeca_information_discovery_studio
  • retail_xstore_point_of_service
  • banking_virtual_account_management
  • banking_platform

xstream

  • xstream
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')