Lucene search

K
cve[email protected]CVE-2016-7051
HistoryApr 14, 2017 - 6:59 p.m.

CVE-2016-7051

2017-04-1418:59:00
CWE-611
CWE-918
web.nvd.nist.gov
57
cve
2016
7051
xmlmapper
jackson xml dataformat
ssrf
server-side request forgery

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

8.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.4%

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

Affected configurations

NVD
Node
fasterxmljackson-dataformat-xmlRange<2.7.8
OR
fasterxmljackson-dataformat-xmlMatch2.8.0-
OR
fasterxmljackson-dataformat-xmlMatch2.8.0rc1
OR
fasterxmljackson-dataformat-xmlMatch2.8.0rc2
OR
fasterxmljackson-dataformat-xmlMatch2.8.1
OR
fasterxmljackson-dataformat-xmlMatch2.8.2
OR
fasterxmljackson-dataformat-xmlMatch2.8.3

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

8.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.4%