CVE-2018-11307

CRITICAL9.8EPSS 12.7%

Deserialization of Untrusted Data in jackson-databind

Published: 7/16/2019Modified: 3/11/2024
Also known as:GHSA-qr7j-h6gg-jmgcDEBIAN-CVE-2018-11307

Description

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Affected packages (4)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (27)