Yüksek CVSS 7.5 PoC var

CVE-2019-12086: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: 17 Mayıs 2019 20:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %21,95 (yüzdelik 98)
CWE: CWE-502
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.0.0	—	2.6.7.3
fasterxml-jackson-databind	2.7.0	—	2.7.9.6
fasterxml-jackson-databind	2.8.0	—	2.8.11.4
fasterxml-jackson-databind	2.9.0	—	2.9.9
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları