← לוח פגיעויות

CVE-2017-15095

קריטית 9.8

תיאור (מקור, אנגלית)

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

מדדים

CVSS 3.1
9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — סבירות ניצול
8% (אחוזון 100) נכון ל-9/10/2026
CWE
CWE-184, CWE-502

מוצרים מושפעים

fasterxml: jackson-databind; debian: debian linux; redhat: openshift container platform; redhat: satellite; redhat: satellite capsule; redhat: enterprise linux; redhat: jboss enterprise application platform; netapp: oncommand balance; netapp: oncommand performance manager; netapp: oncommand shift; netapp: snapcenter; oracle: banking platform; oracle: clusterware; oracle: communications billing and revenue management; oracle: communications diameter signaling router

קישורים