Home

CVE-2017-15095

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
9.261

Associated Vulnerability

VulnerabilityOS Platform
Multiple Vulnerabilities are affected in Oracle 12.2.0.1Windows
Multiple vulnerabilities are fixed in Jackson-databind 2.6.7.3Windows
Vulnerabilities CVE-2018-5968,CVE-2017-17485,CVE-2017-15095 are fixed in Jackson-databind 2.9.4Windows
Vulnerabilities CVE-2017-17485,CVE-2017-15095 are fixed in Jackson-databind 2.8.11Windows
Vulnerabilities CVE-2017-17485,CVE-2017-15095 are fixed in Jackson-databind 2.7.9.2Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.0.12.0Windows
Vulnerabilities CVE-2017-15095,CVE-2025-21556,CVE-2025-21560,CVE-2025-21564,CVE-2025-21565 are affected in Oracle Agile PLM Framework 9.3.6Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 6.0.0Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 6.4.0Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.1.0Windows
Multiple Vulnerabilities are affected in Netapp Snapcenter 2.3Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Balance 2.3Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Shift 2.3Windows
Vulnerabilities CVE-2017-15095,CVE-2018-2939 are affected in Oracle 18.1Windows
Multiple Vulnerabilities are affected in IBM Aspera Shares 1.10.1Windows
Suite of data-processing tools for Java (USN-4741-1) libjackson-json-java_1.9.2-7ubuntu0.2_all.debLinux
Multiple vulnerabilities are fixed in Jackson-databind for Linux 2.6.7.3Linux
Vulnerabilities CVE-2018-5968,CVE-2017-17485,CVE-2017-15095 are fixed in Jackson-databind for Linux 2.9.4Linux
Vulnerabilities CVE-2017-17485,CVE-2017-15095 are fixed in Jackson-databind for Linux 2.8.11Linux
Vulnerabilities CVE-2017-17485,CVE-2017-15095 are fixed in Jackson-databind for Linux 2.7.9.2Linux
Deserialization of Untrusted Data Vulnerability (CVE-2017-15095)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234