CVE-2018-11307

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Published: Jul 9, 2019
Updated: Jun 9, 2023
CVE: CVE-2018-11307
GHSA: GHSA-qr7j-h6gg-jmgc
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
fasterxml / jackson-databind	2.7.0	2.7.9.4
fasterxml / jackson-databind	2.8.0	2.8.11.2
redhat / openshift_container_platform	3.11	3.11.x
redhat / openshift_container_platform	4.1	4.1.x
oracle / retail_customer_management_and_segmentation_foundation	17.0	17.0.x
oracle / clusterware	12.1.0.2.0	12.1.0.2.0.x
oracle / global_lifecycle_management_opatch	-	11.2.0.3.23
oracle / global_lifecycle_management_opatch	12.2.0.1.0	12.2.0.1.19
oracle / global_lifecycle_management_opatch	13.9.4.0.0	13.9.4.2.1
oracle / utilities_advanced_spatial_and_operational_analytics	2.7.0.1	2.7.0.1.x
oracle / communications_instant_messaging_server	10.0.1.2.0	10.0.1.2.0.x
com.fasterxml.jackson.core / jackson-databind	2.0.0	2.7.9.4
com.fasterxml.jackson.core / jackson-databind	2.8.0	2.8.11.2
com.fasterxml.jackson.core / jackson-databind	2.9.0	2.9.6
fasterxml / jackson-databind	2.0.0	2.6.7.3
fasterxml / jackson-databind	2.9.0	2.9.6

Vulnerability Database

289,599

CVE-2018-11307