SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2018-14721

CriticalCVSS 10.0
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Very high risk
10.46%

96th percentile - higher than 96% of all known CVEs

Summary

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Risk Assessment

An attacker can exploit the vulnerability to conduct SSRF attacks, potentially leading to access to internal network resources or disclosure of sensitive information. The risk affects applications that deserialize untrusted data using a vulnerable version of jackson-databind.

Recommendation

Update jackson-databind to version 2.9.7 or later, which blocks the axis2-jaxws class from polymorphic deserialization. Additionally, consider implementing mechanisms to restrict outbound requests from the application.

Other vulnerabilities in FasterXML jackson-databind

See all
Original NVD description (English source)

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS