CVE-2019-14439 in jackson-databind

Resumen

por MITRE

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Reservar: 2019-07-30
• Moderación: aceptado
• Artículo: VDB-138960
• CPE: listo
• CWE: CWE-200 (confirmado)
• CVSS: 7.5 (NVD)
• EPSS: 0.10850
• KEV: no
• Actividades: muy bajo
• Sector: Finance, Pharma, ...

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2019-14439
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-14439
• CVE Details: https://www.cvedetails.com/cve/CVE-2019-14439/