CVE-2018-14720

CRITICAL

FasterXML jackson-databind 2.6.0-2.6.7.1 - XML External Entity Injection via Polymorphic Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-14720. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository appears to be a partial or incomplete copy of the Jackson Databind library, lacking any exploit code or technical analysis specific to CVE-2018-14720. It includes only a subset of source files and a generic README that describes the library's usage without addressing the vulnerability.

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Exploits (2)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2018-14720-jackson-databind-vulnerable

This repository appears to be a partial or incomplete copy of the Jackson Databind library, lacking any exploit code or technical analysis specific to CVE-2018-14720. It includes only a subset of source files and a generic README that describes the library's usage without addressing the vulnerability.

Classification
Stub 90%
Attack Type
Deserialization
Complexity
Theoretical
Reliability
Theoretical
Target: Jackson Databind (versions affected by CVE-2018-14720)
No auth needed
Prerequisites: None identified in the repository
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec STUB
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2018-14720-jackson-databind-vulnerable

This repository appears to be a partial or incomplete copy of the Jackson Databind library, lacking any exploit code or technical analysis specific to CVE-2018-14720. The README is a generic guide for using Jackson Databind, not a PoC or writeup.

Classification
Stub 90%
Attack Type
Deserialization
Complexity
Trivial
Reliability
Theoretical
Target: Jackson Databind (version unclear, likely 2.x)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (32)

Core 32
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/FasterXML/jackson-databind/issues/2097
Patch, Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0782
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHBA-2019:0959
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1107
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1108
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1106
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1140
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4452
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/May/68
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190530-0003/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1822
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1823
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2858
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3149
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3892
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:4037

Scores

CVSS v3 9.8
EPSS 0.0335
EPSS Percentile 87.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502 CWE-611
Status published
Products (33)
com.fasterxml.jackson.core/jackson-databind 2.9.0 - 2.9.7Maven
debian/debian_linux 8.0
debian/debian_linux 9.0
fasterxml/jackson-databind 2.7.0 rc1 (3 CPE variants)
fasterxml/jackson-databind 2.8.0 rc1 (2 CPE variants)
fasterxml/jackson-databind 2.9.0 pr1 (4 CPE variants)
fasterxml/jackson-databind 2.6.0 - 2.6.7.2
oracle/banking_platform 2.5.0
oracle/banking_platform 2.6.0
oracle/banking_platform 2.6.1
... and 23 more
Published Jan 02, 2019
Tracked Since Feb 18, 2026