by Kastro CVE-2017-7525
FasterXML jackson-databind — A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthent…
Description · from the CVE record
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Affected
ProductAffectedFixed inSource
jackson-databindbefore 2.6.7.1–CNA
jackson-databindbefore 2.7.9.1–CNA
jackson-databindbefore 2.8.9–CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total