The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows attackers to read arbitrary files on the server.

🗓️ 25 Nov 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Jackson-databind vulnerability with unprotected service data enables remote reading of arbitrary server files via crafted payloads.

Reporter	Title	Published	Views	Family All 160
IBM Security Bulletins	Security Bulletin: IBM Maximo Asset Management is vulnerable to Multiple Jackson-Databind CVEs - February 2020	1 Mar 202212:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by Components with known vulnerabilities	6 Oct 202112:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jackson-databind affects IBM Process Mining (Multiple CVEs)	1 Feb 202321:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Jackson-Databind Affects IBM Global High Availability Mailbox (CVE-2019-12814)	9 Oct 201919:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been Identified In Jackson Databind library shipped with IBM Global Mailbox	24 Jul 202017:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple CVEs affect IBM Integration Designer	1 Feb 202319:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	12 Jan 202114:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in FasterXML jackson-databind, Apache Struts, Red Hat JBoss Enterprise Application Platform and jquery-bbq might affect IBM Storage Defender Copy Data Management.	16 May 202519:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller 2019Q4 Security Updater: Multiple Security Vulnerabilities have been identified in IBM Cognos Controller	21 Nov 201916:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities	16 Jun 202221:33	–	ibm

Vulners

Node

red_hat red_hat_jboss_fuseMatch7

oracle database_serverMatch12.1.0.2

oracle database_serverMatch12.2.0.1

oracle database_serverMatch18c

oracle database_serverMatch19c

oracle clusterwareMatch12.1.0.2.0

fasterxml,_llc jackson-databindRange2.0.0–2.9.9

oracle retail_customer_management_and_segmentationMatch17.0

oracle clusterwareMatch19.0.0.0.0

oracle nosql_databaseRange<19.3.12

red_hat red_hat_process_automation_managerMatch7

red_hat red_hat_jboss_fuseMatch6

red_hat red_hat_amq_streamsMatch1

red_hat red_hat_single_sign-onMatch7.3

red_hat red_hat_descision_managerMatch7

red_hat red_hat_jboss_eapMatch7.2

fedora fedoraMatch29

red_hat red_hat_enterprise_linuxMatch8

fedora fedoraMatch30

fedora fedoraMatch31

canonical ubuntuMatch19.10

canonical ubuntuMatch20.04

Source	Link
oracle	www.oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-12814
github	www.github.com/FasterXML/jackson-databind/issues/2341
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
nvd	www.nvd.nist.gov/vuln/detail

21 Nov 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 35.9

CVSS 27.1

EPSS0.10951