Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Remediation

References

CVE-2017-7525

Related Vulnerabilities

phpMyAdmin Resource Management Errors Vulnerability (CVE-2016-6632)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-31802)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43730)

WordPress Possible Security Bypass Vulnerability (0.70 - 4.7.4)

MongoDb Improper Validation of Specified Quantity in Input Vulnerability (CVE-2026-6915)

Severity

Critical

Classification

CVE-2017-7525 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities