Remote Code Execution (RCE)

2020-06-1505:05:38

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.034 Low

EPSS

Percentile

91.5%

JSON

jackson-databind is vulnerable to deserialization of untrusted data that can lead to remote code execution. It is possible because it does not filter the untrusted serialization classes weblogic/oracle-aqjms from interaction between serialization gadgets and typing by default.

CPENameOperatorVersion
jackson-databindle2.9.10.4
jackson-databindle2.8.11.6
jackson-databindle2.7.9.7
data mapper for jacksoneq0.9.8
data mapper for jacksonle0.9.7
data mapper for jacksonle1.9.13
data mapper for jacksonle0.9.9-3
data mapper for jacksoneq0.9.8
data mapper for jacksonle0.9.7
data mapper for jacksonle1.9.13

Name	Operator	Version
jackson-databind	le	2.9.10.4
jackson-databind	le	2.8.11.6
jackson-databind	le	2.7.9.7
data mapper for jackson	eq	0.9.8
data mapper for jackson	le	0.9.7
data mapper for jackson	le	1.9.13
data mapper for jackson	le	0.9.9-3
data mapper for jackson	eq	0.9.8
data mapper for jackson	le	0.9.7
data mapper for jackson	le	1.9.13