View all vulnerabilities

CVE-2018-14720

XML External Entity Reference (XXE) in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
9.8
Score Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
com.fasterxml.jackson.core:jackson-databind >= 2.9.0 < 2.9.7; com.fasterxml.jackson.core:jackson-databind >= 2.8.0 < 2.8.11.3; com.fasterxml.jackson.core:jackson-databind >= 2.7.0 < 2.7.9.5
Severity
Ecosystem
Publish Date
January 4, 2019
Modified Date
March 12, 2024