CVE-2018-14720

CRITICAL9.8EPSS 3.4%

XML External Entity Reference (XXE) in jackson-databind

Published: 1/4/2019Modified: 4/28/2026
Also known as:DEBIAN-CVE-2018-14720

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (35)