CVE-2019-17531 in Oracle Business Intelligence Enterprise Edition

Summary

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Reservation

10/12/2019

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
234846	Oracle Business Intelligence Enterprise Edition Analytics Server deserialization	502	Not defined	Official fix	CVE-2019-17531
163180	Oracle GoldenGate Application Adapters Build Request deserialization	502	Not defined	Official fix	CVE-2019-17531
158271	Oracle WebCenter Portal Security input validation	20	Not defined	Official fix	CVE-2019-17531
143428	FasterXML jackson-databind JSON Endpoint input validation	20	Not defined	Not defined	CVE-2019-17531