CVE-2018-14720

CriticalCVSS 9.8

Published: 02/01/2019(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

7.52%

94th percentile - higher than 94% of all known CVEs

Summary

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Risk Assessment

An attacker can exploit the vulnerability to conduct XXE attacks, potentially leading to file disclosure, SSRF attacks, or denial of service. The risk affects applications that deserialize untrusted data using a vulnerable version of jackson-databind.

Recommendation

Update jackson-databind to version 2.9.7 or later, which blocks unspecified JDK classes from polymorphic deserialization. Additionally, consider disabling external XML entity processing in parsers used by the application.

Other vulnerabilities in FasterXML jackson-databind

See all

Original NVD description (English source)

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS