Vulnerability CVE-2019-14892


Published: 2020-03-02

Description:
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Type:

CWE-502

(Deserialization of Untrusted Data)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Redhat -> Decision manager 
Redhat -> Jboss data grid 
Redhat -> Jboss enterprise application platform 
Redhat -> Jboss fuse 
Redhat -> Openshift container platform 
Redhat -> Process automation 
Fasterxml -> Jackson-databind 

 References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892
https://github.com/FasterXML/jackson-databind/issues/2462

Copyright 2024, cxsecurity.com

 

Back to Top