GitHub Advisoryadvisory · Maven

GHSA-7c2r-3jqf-c9rw jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

HIGH Published 2018-10-18 Modified 2022-09-14 Official page ↗
Aliases
CVE-2016-7051
Ecosystem
Maven
Packages
com.fasterxml.jackson.dataformat:jackson-dataformat-xml
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-611, CWE-918
Reviewed
2020-06-16

Affected packages

• Maven com.fasterxml.jackson.dataformat:jackson-dataformat-xml: < 2.7.8 → fixed in 2.7.8 • Maven com.fasterxml.jackson.dataformat:jackson-dataformat-xml: >= 2.8.0, < 2.8.4 → fixed in 2.8.4

Description

Versions of jackson-dataformat-xml) prior to 2.7.8 and prior to 2.8.4 allow remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

Related

Alias · CVE (1)

  • CVE-2016-7051 XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers… vulnerability

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-918 Server-Side Request Forgery weakness

References