Description

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Remediation

References

CVE-2018-14720

Related Vulnerabilities

WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-0541)

WordPress Plugin PS PHPCaptcha WP Denial of Service (1.1.0)

WordPress Plugin WP Marketplace-Complete Shopping Cart/eCommerce Solution 'uploadify.php' Arbitrary File Upload (1.6.1)

WordPress Improper Authentication Vulnerability (CVE-2009-2334)

Zope Web Application Server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-32633)

Severity

Critical

Classification

CVE-2018-14720 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities