CVE-2018-14720Critical· 9.8▾ MidnightFasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 1.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
7.5%
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
jackson-databind >= 2.6.0, < 2.6.7.2jackson-databind >= 2.7.0, < 2.7.9.5jackson-databind >= 2.8.0, < 2.8.11.3jackson-databind >= 2.9.0, < 2.9.7jackson-databind = 2.7.0jackson-databind = 2.8.0jackson-databind = 2.9.0debian_linux = 8.0debian_linux = 9.0banking_platform = 2.5.0banking_platform = 2.6.0banking_platform = 2.6.1banking_platform = 2.6.2communications_billing_and_revenue_management = 7.5communications_billing_and_revenue_management = 12.0enterprise_manager_for_virtualization = 13.2.2enterprise_manager_for_virtualization = 13.2.3enterprise_manager_for_virtualization = 13.3.1financial_services_analytical_applications_infrastructure = 8.0.2financial_services_analytical_applications_infrastructure = 8.0.3financial_services_analytical_applications_infrastructure = 8.0.4financial_services_analytical_applications_infrastructure = 8.0.5financial_services_analytical_applications_infrastructure = 8.0.6financial_services_analytical_applications_infrastructure = 8.0.7jdeveloper = 12.1.3.0.0jdeveloper = 12.2.1.3.0primavera_unifier >= 17.1, <= 17.12primavera_unifier = 16.1primavera_unifier = 16.2primavera_unifier = 18.8retail_merchandising_system = 15.0retail_merchandising_system = 16.0webcenter_portal = 12.2.1.3.0jboss_enterprise_application_platform = 7.2.0openshift_container_platform = 3.11Upgrade past the affected range:
jackson-databind 2.9.7Connected by shared product, vendor, weakness, or advisory.
CVE-2018-12023High· 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6
CVE-2018-19362Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19360Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-19361Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-7489Critical· 9.8FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw
CVE-2017-15095Critical· 9.8A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of th…