CVE-2018-12022
Description
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
3.035
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2018-12023,CVE-2018-11307,CVE-2018-12022 are fixed in Jackson-databind 2.7.9.4 | Windows |
| Vulnerabilities CVE-2018-12023,CVE-2018-11307,CVE-2018-12022 are fixed in Jackson-databind 2.8.11.2 | Windows |
| Vulnerabilities CVE-2018-12023,CVE-2018-11307,CVE-2018-12022 are fixed in Jackson-databind 2.9.6 | Windows |
| Multiple Vulnerabilities are affected in JD Edwards EnterpriseOne Tools 9.2 | Windows |
| Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.2.0 | Windows |
| Vulnerabilities CVE-2018-12023,CVE-2018-11307,CVE-2018-12022 are fixed in Jackson-databind for Linux 2.7.9.4 | Linux |
| Vulnerabilities CVE-2018-12023,CVE-2018-11307,CVE-2018-12022 are fixed in Jackson-databind for Linux 2.8.11.2 | Linux |
| Vulnerabilities CVE-2018-12023,CVE-2018-11307,CVE-2018-12022 are fixed in Jackson-databind for Linux 2.9.6 | Linux |
| Deserialization of Untrusted Data Vulnerability (CVE-2018-12022) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234