Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Remediation
References
Related Vulnerabilities
Nginx Improper Certificate Validation Vulnerability (CVE-2021-3618)
WordPress Plugin Site Offline Or Coming Soon Or Maintenance Mode Cross-Site Request Forgery (1.4.3)
ownCloud Uncontrolled Resource Consumption Vulnerability (CVE-2017-5867)
Apache Tomcat Incorrect Authorization Vulnerability (CVE-2016-6797)