ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2017-15095

—
CVSS 3.1
9.8 critical
EPSS
8%p95
Published
()
Modified
Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Vendors
fasterxmldebianredhatnetapporacle
Products
jackson-databind, debian linux, openshift container platform, satellite, satellite capsule, jboss enterprise application platform, oncommand balance, oncommand performance manager, oncommand shift, snapcenter, banking platform, clusterware
Weakness
CWE-184, CWE-502
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (8.4%)

In the news

No ingested article mentions this CVE yet.