CVE-2018-11307
CRITICALFasterxml Jackson-databind < 2.6.7.3 - Insecure Deserialization
Title source: ruleDescription
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
Exploits (2)
nomisec
WORKING POC
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2018-11307-jackson-databind-vulnerable
nomisec
WORKING POC
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2018-11307-jackson-databind-vulnerable
References (21)
... and 1 more
Scores
CVSS v3
9.8
EPSS
0.1243
EPSS Percentile
93.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (9)
com.fasterxml.jackson.core/jackson-databind
2.0.0 - 2.7.9.4Maven
fasterxml/jackson-databind
2.0.0 - 2.6.7.3
oracle/clusterware
12.1.0.2.0
oracle/communications_instant_messaging_server
10.0.1.2.0
oracle/global_lifecycle_management_opatch
< 11.2.0.3.23
oracle/retail_customer_management_and_segmentation_foundation
17.0
oracle/utilities_advanced_spatial_and_operational_analytics
2.7.0.1
redhat/openshift_container_platform
3.11
redhat/openshift_container_platform
4.1
Published
Jul 09, 2019
Tracked Since
Feb 18, 2026