CVE-2018-11307

CRITICAL

Fasterxml Jackson-databind < 2.6.7.3 - Insecure Deserialization

Title source: rule

Description

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Exploits (2)

nomisec WORKING POC
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2018-11307-jackson-databind-vulnerable
nomisec WORKING POC
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2018-11307-jackson-databind-vulnerable

References (21)

... and 1 more

Scores

CVSS v3 9.8
EPSS 0.1264
EPSS Percentile 93.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-502
Status published

Affected Products (9)

fasterxml/jackson-databind < 2.6.7.3
redhat/openshift_container_platform
redhat/openshift_container_platform
oracle/clusterware
oracle/communications_instant_messaging_server
oracle/global_lifecycle_management_opatch < 11.2.0.3.23
oracle/retail_customer_management_and_segmentation_foundation
oracle/utilities_advanced_spatial_and_operational_analytics
com.fasterxml.jackson.core/jackson-databind < 2.7.9.4Maven

Timeline

Published Jul 09, 2019
Tracked Since Feb 18, 2026