CVE-2019-16943
CRITICALjackson-databind 2.0.0-2.9.10 - Remote Code Execution via P6Spy Default Typing
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-16943. PoCs published by dawetmaster, andikahilmy.
AI-analyzed exploit summary The repository contains a partial copy of the Jackson Databind library but lacks any exploit code or technical analysis related to CVE-2019-16943. It appears to be a placeholder or incomplete project.
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Exploits (2)
The repository contains a partial copy of the Jackson Databind library but lacks any exploit code or technical analysis related to CVE-2019-16943. It appears to be a placeholder or incomplete project.
The repository contains a partial snapshot of the Jackson Databind library but lacks any exploit code or technical analysis specific to CVE-2019-16943. It includes only a subset of source files and a generic README with no vulnerability details.
References (26)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H