Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Remediation

References

CVE-2017-7525

Related Vulnerabilities

LimeSurvey Improper Certificate Validation Vulnerability (CVE-2019-16179)

MySQL CVE-2015-4791 Vulnerability (CVE-2015-4791)

PHP Other Vulnerability (CVE-2006-2660)

WordPress Plugin MailPoet Newsletters (Previous) Multiple Unspecified Vulnerabilities (2.7.1)

MySQL CVE-2015-4861 Vulnerability (CVE-2015-4861)

Severity

Critical

Classification

CVE-2017-7525 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities