Critical severity · published Oct 1, 2019
CVE-2019-16943
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10
9.8
CVSS
4.7%
EPSS
No
On KEV
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
AI
Active IQ Unified Manager · Netapp
7.3 and later; 7.3 and later; 9.5 and later · source: NVD
BP
Banking Platform · Oracle
2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more · source: NVD
CB
Communications Billing And Revenue Management · Oracle
7.5.0.23.0; 12.0.0.3.0 · source: NVD
CC
Communications Calendar Server · Oracle
8.0.0.2.0; 8.0.0.3.0 · source: NVD
CC
Communications Cloud Native Core Network Slice Selection Function · Oracle
1.2.1 · source: NVD
CE
Communications Evolved Communications Application Server · Oracle
7.1 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0; 10.0 · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
GL
Global Lifecycle Management Nextgen Oui Framework · Oracle
12.2.1.3.0; 12.2.1.4.0; 13.9.4.2.2 · source: NVD
GA
Goldengate Application Adapters · Oracle
19.1.0.0.0 · source: NVD
JE
JD Edwards Enterpriseone Orchestrator · Oracle
9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16943
mailing-list
https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html
vendor-advisory
https://www.debian.org/security/2019/dsa-4542
mailing-list
https://seclists.org/bugtraq/2019/Oct/6
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
mailing-list
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability