Description

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Remediation

References

CVE-2018-14720

Related Vulnerabilities

WordPress Plugin GEO my WordPress Unspecified Vulnerability (2.6.1.1)

OpenSSL Session Fixation Vulnerability (CVE-1999-0428)

WordPress Plugin WP125 Cross-Site Request Forgery (1.4.9)

Oracle JRE CVE-2018-2639 Vulnerability (CVE-2018-2639)

Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.17)

Severity

Critical

Classification

CVE-2018-14720 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities