CVE-2018-19362Critical· 9.8▾ MidnightFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 2.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
11%
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
jackson-databind >= 2.6.0, <= 2.6.7.2jackson-databind >= 2.7.0, < 2.7.9.5jackson-databind >= 2.8.0, < 2.8.11.3jackson-databind >= 2.9.0, < 2.9.8debian_linux = 8.0business_process_management_suite = 12.1.3.0.0business_process_management_suite = 12.2.1.3.0primavera_p6_enterprise_project_portfolio_management >= 17.7, <= 17.12primavera_p6_enterprise_project_portfolio_management = 15.1primavera_p6_enterprise_project_portfolio_management = 15.2primavera_p6_enterprise_project_portfolio_management = 16.1primavera_p6_enterprise_project_portfolio_management = 16.2primavera_p6_enterprise_project_portfolio_management = 18.8primavera_unifier >= 17.7, <= 17.12primavera_unifier = 16.1primavera_unifier = 16.2primavera_unifier = 18.8retail_workforce_management_software = 1.60.9.0.0webcenter_portal = 12.2.1.3.0automation_manager = 7.3.1decision_manager = 7.3.1jboss_bpm_suite = 6.4.11jboss_brms = 6.4.10openshift_container_platform = 3.11Upgrade past the affected range:
jackson-databind 2.9.8Connected by shared product, vendor, weakness, or advisory.
CVE-2018-12023High· 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6
CVE-2018-19360Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-19361Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-14720Critical· 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-7489Critical· 9.8FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw
CVE-2019-14893Critical· 9.8A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic ty…