[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2017-17485Date: (C)2018-01-22   (M)2023-12-22


FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 9.8CVSS Score : 7.5
Exploit Score: 3.9Exploit Score: 10.0
Impact Score: 5.9Impact Score: 6.4
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: LOW
Privileges Required: NONEAuthentication: NONE
User Interaction: NONEConfidentiality: PARTIAL
Scope: UNCHANGEDIntegrity: PARTIAL
Confidentiality: HIGHAvailability: PARTIAL
Integrity: HIGH 
Availability: HIGH 
  
Reference:
http://www.securityfocus.com/archive/1/541652/100/0/threaded
DSA-4114
RHSA-2018:0116
RHSA-2018:0342
RHSA-2018:0478
RHSA-2018:0479
RHSA-2018:0480
RHSA-2018:0481
RHSA-2018:1447
RHSA-2018:1448
RHSA-2018:1449
RHSA-2018:1450
RHSA-2018:1451
RHSA-2018:2930
RHSA-2019:1782
RHSA-2019:1797
RHSA-2019:2858
RHSA-2019:3149
RHSA-2019:3892
https://github.com/FasterXML/jackson-databind/issues/1855
https://github.com/irsl/jackson-rce-via-spel/
https://security.netapp.com/advisory/ntap-20180201-0003/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
https://www.oracle.com/security-alerts/cpuoct2020.html

CWE    1
CWE-502
OVAL    8
oval:org.secpod.oval:def:505067
oval:org.secpod.oval:def:504924
oval:org.secpod.oval:def:113994
oval:org.secpod.oval:def:113995
...

© SecPod Technologies