IBM2FF199638646AE6211E47540E7CE178E9DCA1E8BFA8BC190A0A961F389C35BE0Security Bulletin: Vulnerability in Jackson-Databind Affects IBM Global High Availability Mailbox (CVE-2019-12814)
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
Summary
Vulnerability CVE-2019-12814 in jackson-databind affects IBM Global High Availability Mailbox
Vulnerability Details
CVEID:CVE-2019-12814 DESCRIPTION: FasterXML jackson-databind could enable a remote attacker to obtain sensitive information, where the vulnerability is caused by a polymorphic typing issue. By sending a specially-crafted JSON message, an attacker could exploit the vulnerability to read arbitrary local files on the server.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/162875> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N )
Affected Products and Versions
IBM Global High Availability Mailbox 6.0.0, 6.0.1, 6.0.2
Remediation/Fixes
| Product Name | VRMF | FIX CENTRAL |
|---|---|---|
| IBM Global High Availability Mailbox | 6.0.0, 6.0.1, 6.0.2 | Upgrade to version 6.0.3 |
Workarounds and Mitigations
None
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N