CVEvulnerability

CVE-2019-14893

9.8 CRITICAL Published 2020-03-02 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-03-02
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-200, CWE-502

Description

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Affected configurations

• fasterxml jackson-databind (>= 2.8.0 < 2.8.11.5) • fasterxml jackson-databind (>= 2.9.0 < 2.9.10) • netapp oncommand api services • netapp steelstore cloud integrated storage • oracle goldengate stream analytics (< 19.1.0.0.1)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References