CVE-2019-14893

Katalog CVE

CVSS 9.8 · Critical EPSS 4,1%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada fasterxml jackson-databind, netapp oncommand api services +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Rincian

Terbit di NVD

2 Maret 2020

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893 issue tracking · patch · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0729 advisory pihak ketiga
• https://github.com/FasterXML/jackson-databind/issues/2469 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200327-0006/ advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2020.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2020.html advisory pihak ketiga
• https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.boo...
• https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geo...