NetSight
IP …
critical10.0

CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block t…

Impact

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.6.0 before 2.6.7.2
from 2.7.0 before 2.7.9.5
from 2.8.0 before 2.8.11.3
from 2.9.0 before 2.9.7
Versions 2.7.0, 2.8.0
DebianDebian Linux
Versions 8.0, 9.0
OracleBanking Platform
Versions 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleCommunications Billing And Revenue Management
Versions 7.5, 12.0
OracleEnterprise Manager For Virtualization
Versions 13.2.2, 13.2.3, 13.3.1
OracleFinancial Services Analytical Applications Infrastructure
Versions 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
OracleJdeveloper
Versions 12.1.3.0.0, 12.2.1.3.0
OraclePrimavera Unifier
from 17.1 through 17.12
Versions 16.1, 16.2, 18.8
OracleRetail Merchandising System
Versions 15.0, 16.0
OracleWebcenter Portal
Version 12.2.1.3.0
RedhatJboss Enterprise Application Platform
Version 7.2.0
RedhatOpenshift Container Platform
Version 3.11

Weakness classification

CWE-918

References