← לוח פגיעויות

CVE-2019-16942

קריטית 9.8

תיאור (מקור, אנגלית)

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

מדדים

CVSS 3.1
9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — סבירות ניצול
6% (אחוזון 100) נכון ל-14/10/2026
CWE
CWE-502

מוצרים מושפעים

fasterxml: jackson-databind; debian: debian linux; fedoraproject: fedora; redhat: jboss enterprise application platform; redhat: enterprise linux; netapp: active iq unified manager; netapp: oncommand api services; netapp: oncommand workflow automation; netapp: service level manager; netapp: steelstore cloud integrated storage; oracle: banking platform; oracle: communications billing and revenue management; oracle: communications calendar server; oracle: communications cloud native core network slice selection function; oracle: communications evolved communications application server

קישורים