1. Home
  2. Vulnerabilities
  3. CVE-2018-7489
9.8
CRITICAL CVSS 3.0
CVE-2018-7489
FasterXML Jackson Databind Remote Code Execution Vulnerability
Description

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

INFO

Published Date :

Feb. 26, 2018, 3:29 p.m.

Last Modified :

Nov. 21, 2024, 4:12 a.m.

Remotely Exploit :

Yes !

Source :

[email protected]
Affected Products

The following products are affected by CVE-2018-7489 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Oracle communications_billing_and_revenue_management
2 Oracle communications_instant_messaging_server
1 Debian debian_linux
1 Redhat jboss_enterprise_application_platform
1 Fasterxml jackson-databind
: Total Affected Vendor : 4 | Products : 5
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 2.0 HIGH [email protected]
CVSS 3.0 CRITICAL [email protected]
Solution
This vulnerability allows for remote code execution; therefore, it is recommended to update the affected software to a patched version or apply vendor-provided security updates.
  • Update the affected jackson-databind package.
  • Apply the appropriate patches or upgrade to the latest versions as recommended by the vendor for your specific product and version.
  • If applicable, update the Red Hat JBoss Enterprise Application Platform package based on the vendor guidance.
Public PoC/Exploit Available at Github

CVE-2018-7489 has a 20 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2018-7489.

URL Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
http://www.securityfocus.com/bid/103203 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040693 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041890 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1786 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2088 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2089 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2090 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2938 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:3149
https://github.com/FasterXML/jackson-databind/issues/1931 Third Party Advisory
https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
https://security.netapp.com/advisory/ntap-20180328-0001/ Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
https://www.debian.org/security/2018/dsa-4190 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
http://www.securityfocus.com/bid/103203 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040693 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041890 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1786 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2088 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2089 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2090 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2938 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:3149
https://github.com/FasterXML/jackson-databind/issues/1931 Third Party Advisory
https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
https://security.netapp.com/advisory/ntap-20180328-0001/ Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
https://www.debian.org/security/2018/dsa-4190 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2018-7489 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2018-7489 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
SarthakShieldersoft/TestVWA

None

Batchfile Java CSS PowerShell

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : July 30, 2025, 12:42 p.m. This repo has been linked 12 different CVEs too.
Profile Photo
seal-community/patches

A centralized repository of standalone security patches for open source libraries.

appsec backport cve devsecops fix hotfix open-source patch protection remediation seal security update upgrade vulnerability

Updated: 1 year, 2 months ago
182 stars 0 fork 0 watcher
Born at : July 30, 2023, 4:46 p.m. This repo has been linked 265 different CVEs too.
Profile Photo
hectorgie/PoC-in-GitHub

None

Updated: 5 months, 2 weeks ago
18 stars 10 fork 10 watcher
Born at : Jan. 2, 2021, 10:19 p.m. This repo has been linked 1053 different CVEs too.
Profile Photo
yahoo/cubed

Data Mart As A Service

bigdata datamart etl funnel-analysis dataanalysis businessintelligence saas

Makefile Java Python Shell CSS HTML HiveQL StringTemplate

Updated: 6 months, 3 weeks ago
28 stars 5 fork 5 watcher
Born at : Nov. 24, 2020, 5:03 a.m. This repo has been linked 54 different CVEs too.
Profile Photo
cf-testorg/aws-sdk-java-test

None

Java Gherkin FreeMarker Shell Batchfile Scilab

Updated: 4 years, 11 months ago
0 stars 1 fork 1 watcher
Born at : Oct. 9, 2020, 5:05 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
0xT11/CVE-POC

None

Updated: 2 months, 2 weeks ago
84 stars 31 fork 31 watcher
Born at : Oct. 2, 2020, 2:49 p.m. This repo has been linked 1114 different CVEs too.
Profile Photo
PalindromeLabs/Java-Deserialization-CVEs

Compiled dataset of Java deserialization CVEs

java-deserialization deserialization cve security

Updated: 1 month, 4 weeks ago
62 stars 4 fork 4 watcher
Born at : July 22, 2020, 1:10 p.m. This repo has been linked 308 different CVEs too.
Profile Photo
dotanuki-labs/android-oss-cves-research

An analysis on open-source Android apps intended to learn if they are harmed by vulnerable dependencies 🔒

gradle cli security supply-chain-analytics python

Python Shell

Updated: 3 years, 7 months ago
8 stars 2 fork 2 watcher
Born at : June 4, 2020, 9:48 p.m. This repo has been linked 15 different CVEs too.
Profile Photo
zema1/oracle-vuln-crawler

抓取 Weblogic 等 Oracle 组件的历史漏洞信息

Go

Updated: 1 year, 8 months ago
6 stars 1 fork 1 watcher
Born at : March 13, 2020, 1:17 p.m. This repo has been linked 33 different CVEs too.
Profile Photo
ilmari666/cybsec

Cyber Securiy MOOC Unsecure project

Java HTML

Updated: 3 years, 2 months ago
1 stars 1 fork 1 watcher
Born at : Dec. 29, 2019, 12:57 p.m. This repo has been linked 70 different CVEs too.
Profile Photo
maddoudou22/test-aws-sdk-java-B

None

Batchfile Java Gherkin FreeMarker Shell Scilab

Updated: 6 years, 2 months ago
0 stars 1 fork 1 watcher
Born at : June 26, 2019, 12:39 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
maddoudou22/test-aws-sdk-java

None

Batchfile Java Gherkin FreeMarker Shell Scilab

Updated: 6 years, 2 months ago
0 stars 0 fork 0 watcher
Born at : May 25, 2019, 11:23 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
maddoudou22/repo-aws-sdk-java

None

Java Gherkin FreeMarker Shell Batchfile Scilab

Updated: 6 years, 6 months ago
0 stars 0 fork 0 watcher
Born at : Feb. 15, 2019, 1:54 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
tafamace/CVE-2018-7489

None

Java

Updated: 6 years, 9 months ago
0 stars 0 fork 0 watcher
Born at : Nov. 19, 2018, 1:13 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
dashpradeep99/https-github.com-aws-aws-sdk-java

None

Java Gherkin FreeMarker Scilab

Updated: 6 years, 10 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 25, 2018, 8:39 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2018-7489 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2018-7489 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    Added Reference http://www.securityfocus.com/bid/103203
    Added Reference http://www.securitytracker.com/id/1040693
    Added Reference http://www.securitytracker.com/id/1041890
    Added Reference https://access.redhat.com/errata/RHSA-2018:1447
    Added Reference https://access.redhat.com/errata/RHSA-2018:1448
    Added Reference https://access.redhat.com/errata/RHSA-2018:1449
    Added Reference https://access.redhat.com/errata/RHSA-2018:1450
    Added Reference https://access.redhat.com/errata/RHSA-2018:1451
    Added Reference https://access.redhat.com/errata/RHSA-2018:1786
    Added Reference https://access.redhat.com/errata/RHSA-2018:2088
    Added Reference https://access.redhat.com/errata/RHSA-2018:2089
    Added Reference https://access.redhat.com/errata/RHSA-2018:2090
    Added Reference https://access.redhat.com/errata/RHSA-2018:2938
    Added Reference https://access.redhat.com/errata/RHSA-2018:2939
    Added Reference https://access.redhat.com/errata/RHSA-2019:2858
    Added Reference https://access.redhat.com/errata/RHSA-2019:3149
    Added Reference https://github.com/FasterXML/jackson-databind/issues/1931
    Added Reference https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
    Added Reference https://security.netapp.com/advisory/ntap-20180328-0001/
    Added Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
    Added Reference https://www.debian.org/security/2018/dsa-4190
    Added Reference https://www.oracle.com/security-alerts/cpuoct2020.html
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E [No types assigned]
    Removed Reference MITRE https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E
  • CVE Modified by [email protected]

    Mar. 25, 2021

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 20, 2020

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuoct2020.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 18, 2019

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2019:3149 [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 27, 2019

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2019:2858 [No Types Assigned]
  • Modified Analysis by [email protected]

    Aug. 22, 2019

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html No Types Assigned https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
    Added CPE Configuration OR *cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.19:*:*:*:*:*:*:* *cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.2:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jul. 23, 2019

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html [No Types Assigned]
  • Modified Analysis by [email protected]

    May. 10, 2019

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html No Types Assigned https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Apr. 23, 2019

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Mar. 26, 2019

    Action Type Old Value New Value
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2938 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2938 Third Party Advisory
    Changed Reference Type https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us No Types Assigned https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
    Changed Reference Type http://www.securitytracker.com/id/1041890 No Types Assigned http://www.securitytracker.com/id/1041890 Third Party Advisory, VDB Entry
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1448 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1449 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1447 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
    Changed Reference Type http://www.securitytracker.com/id/1040693 No Types Assigned http://www.securitytracker.com/id/1040693 Third Party Advisory, VDB Entry
    Changed Reference Type https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html No Types Assigned https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
    Changed Reference Type https://security.netapp.com/advisory/ntap-20180328-0001/ No Types Assigned https://security.netapp.com/advisory/ntap-20180328-0001/ Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2939 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2018/dsa-4190 No Types Assigned https://www.debian.org/security/2018/dsa-4190 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2090 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2090 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1786 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1786 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1451 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2089 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2089 Third Party Advisory
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:1450 No Types Assigned https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
    Changed Reference Type https://access.redhat.com/errata/RHSA-2018:2088 No Types Assigned https://access.redhat.com/errata/RHSA-2018:2088 Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions up to (excluding) 2.8.11.1 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (including) 2.9.4 OR *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.9.3 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (excluding) 2.8.11.1 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (excluding) 2.9.5
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jan. 16, 2019

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2018

    Action Type Old Value New Value
    Changed Description FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
  • CVE Modified by [email protected]

    Oct. 18, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:2939 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:2938 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 17, 2018

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1041890 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 17, 2018

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 27, 2018

    Action Type Old Value New Value
    Removed Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03902en_us [No Types Assigned]
  • CVE Modified by [email protected]

    Sep. 27, 2018

    Action Type Old Value New Value
    Added Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us [No Types Assigned]
    Added Reference https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03902en_us [No Types Assigned]
  • CVE Modified by [email protected]

    Jul. 19, 2018

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 29, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:2090 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:2089 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:2088 [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 06, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:1786 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 17, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2018:1451 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1450 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1449 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1448 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2018:1447 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 05, 2018

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2018/dsa-4190 [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 20, 2018

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 19, 2018

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1040693 [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 30, 2018

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20180328-0001/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Mar. 22, 2018

    Action Type Old Value New Value
    Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
    Added CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://github.com/FasterXML/jackson-databind/issues/1931 No Types Assigned https://github.com/FasterXML/jackson-databind/issues/1931 Third Party Advisory
    Changed Reference Type http://www.securityfocus.com/bid/103203 No Types Assigned http://www.securityfocus.com/bid/103203 Third Party Advisory, VDB Entry
    Added CWE CWE-502
    Added CWE CWE-184
    Added CPE Configuration OR *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions up to (excluding) 2.8.11.1 *cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (including) 2.9.4
  • CVE Modified by [email protected]

    Mar. 06, 2018

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/103203 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Base CVSS Score: 7.5
Access Vector
Access Complexity
Authentication
Confidentiality Impact
Integrity Impact
Availability Impact
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

36.21 }} 13.72%

score

0.96994

percentile