CVE-2018-14718Critical· 9.8▾ MidnightFasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 2.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
13%
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
jackson-databind >= 2.0.0, < 2.6.7.3jackson-databind >= 2.7.0, < 2.7.9.5jackson-databind >= 2.8.0, < 2.8.11.3jackson-databind >= 2.9.0, < 2.9.7debian_linux = 8.0debian_linux = 9.0banking_platform = 2.5.0banking_platform = 2.6.0banking_platform = 2.6.1banking_platform = 2.6.2business_process_management_suite = 12.1.3.0.0business_process_management_suite = 12.2.1.3.0communications_billing_and_revenue_management = 7.5communications_billing_and_revenue_management = 12.0communications_instant_messaging_server = 10.0.1.3.0enterprise_manager_for_virtualization = 13.2.2enterprise_manager_for_virtualization = 13.2.3enterprise_manager_for_virtualization = 13.3.1financial_services_analytical_applications_infrastructure = 8.0.2financial_services_analytical_applications_infrastructure = 8.0.3financial_services_analytical_applications_infrastructure = 8.0.4financial_services_analytical_applications_infrastructure = 8.0.5financial_services_analytical_applications_infrastructure = 8.0.6financial_services_analytical_applications_infrastructure = 8.0.7global_lifecycle_management_opatch < 11.2.0.3.23global_lifecycle_management_opatch >= 12.2.0.1.0, < 12.2.0.1.19global_lifecycle_management_opatch >= 13.9.4.0.0, < 13.9.4.2.1jd_edwards_enterpriseone_orchestrator = 9.2jd_edwards_enterpriseone_tools = 9.2jdeveloper = 12.1.3.0.0jdeveloper = 12.2.1.3.0nosql_database < 19.3.12nosql_database = 19.3.12primavera_p6_enterprise_project_portfolio_management >= 17.7, <= 17.12primavera_p6_enterprise_project_portfolio_management = 15.1primavera_p6_enterprise_project_portfolio_management = 15.2primavera_p6_enterprise_project_portfolio_management = 16.1primavera_p6_enterprise_project_portfolio_management = 16.2primavera_p6_enterprise_project_portfolio_management = 18.8primavera_unifier >= 17.7, <= 17.12primavera_unifier = 16.1primavera_unifier = 16.2primavera_unifier = 18.8retail_customer_management_and_segmentation_foundation = 17.0retail_merchandising_system = 15.0retail_merchandising_system = 16.0retail_workforce_management_software = 1.60.9.0.0siebel_engineering_-_installer_&_deployment <= 19.8siebel_ui_framework <= 19.10webcenter_portal = 12.2.1.3.0oncommand_workflow_automationsnapcentersteelstore_cloud_integrated_storageopenshift_container_platform >= 3.11, < 3.11.153openshift_container_platform >= 4.6, < 4.6.26openshift_container_platform = 3.10openshift_container_platform >= 4.1, < 4.1.18Upgrade past the affected range:
jackson-databind 2.9.7global_lifecycle_management_opatch 13.9.4.2.1nosql_database 19.3.12openshift_container_platform 4.1.18Connected by shared product, vendor, weakness, or advisory.
CVE-2018-12023High· 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6
CVE-2018-19362Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-19360Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-19361Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-14720Critical· 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-7489Critical· 9.8FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw