Lucene search

[email protected]NVD:CVE-2019-14893

HistoryMar 02, 2020 - 9:15 p.m.

CVE-2019-14893

2020-03-0221:15:17

CWE-200

CWE-502

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.025

Percentile

90.1%

JSON

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Affected configurations

Nvd

Node

fasterxmljackson-databindRange2.8.0–2.8.11.5

fasterxmljackson-databindRange2.9.0–2.9.10

Node

netapponcommand_api_servicesMatch-

netappsteelstore_cloud_integrated_storageMatch-

Node

oraclegoldengate_stream_analyticsRange<19.1.0.0.1

VendorProductVersionCPE
fasterxmljackson-databind*cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
netapponcommand_api_services-cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
netappsteelstore_cloud_integrated_storage-cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
oraclegoldengate_stream_analytics*cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fasterxml	jackson-databind	*	cpe:2.3:a:fasterxml:jackson-databind::::::::
netapp	oncommand_api_services	-	cpe:2.3:a:netapp:oncommand_api_services:-:::::::*
netapp	steelstore_cloud_integrated_storage	-	cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*
oracle	goldengate_stream_analytics	*	cpe:2.3:a:oracle:goldengate_stream_analytics::::::::