Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Remediation

References

CVE-2017-7525

Related Vulnerabilities

WordPress Plugin WP Editor Multiple Vulnerabilities (1.2.5.3)

WordPress Plugin Anti-Malware Security and Brute-Force Firewall Multiple Cross-Site Scripting Vulnerabilities (4.15.17)

TCExam Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2020-5744)

Apache HTTP Server Other Vulnerability (CVE-1999-0926)

WordPress Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2022-3590)

Severity

Critical

Classification

CVE-2017-7525 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities