Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
Remediation
References
Related Vulnerabilities
TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2022-23503)
WordPress Plugin WP Coder-add custom html, css and js code SQL Injection (2.5.3)
WordPress Plugin GigPress Multiple Vulnerabilities (2.3.10)
WordPress Plugin Coming soon and Maintenance mode Unspecified Vulnerability (3.5.4)
WordPress Plugin Header Footer Code Manager SQL Injection (1.1.13)