Critical severity · published Feb 6, 2018
CVE-2017-7525
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by…
9.8
CVSS
37.7%
EPSS
No
On KEV
Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)37.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
jackson-databind · FasterXML
before 2.6.7.1; before 2.7.9.1; before 2.8.9 · source: vendor, NVD
BP
Banking Platform · Oracle
2.5.0; 2.6.0; 2.6.1; 2.6.2 · source: NVD
CB
Communications Billing And Revenue Management · Oracle
7.5; 12.0 · source: NVD
CC
Communications Communications Policy Management · Oracle
12.0 through 12.5.2 · source: NVD
CD
Communications Diameter Signaling Route · Oracle
before 8.3 · source: NVD
CI
Communications Instant Messaging Server · Oracle
10.0.1; 10.0.1.2.0 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
EM
Enterprise Manager For Virtualization · Oracle
13.2.2; 13.2.3; 13.3.1 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.2.0.0; 8.0.3.0.0; 8.0.4.0.0; 8.0.5.0.0; 8.0.6.0.0; 8.0.7.0.0 · source: NVD
GL
Global Lifecycle Management Opatchauto · Oracle
before 12.2.0.1.14 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
6.0.0; 6.4.0; 7.0; 7.1; 6.0.0; 6.4.0 · source: NVD
OB
Oncommand Balance · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7525
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7525
Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory
http://www.securityfocus.com/bid/99623
Third Party Advisory
http://www.securitytracker.com/id/1039744
Third Party Advisory
http://www.securitytracker.com/id/1039947
More from jackson-databind
10.0
CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…
9.8
CVE-2026-110879
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
9.8
CVE-2019-14893
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the…
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2020-9546
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…