CVE-2019-17531
CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Affected Platforms (CPE)
📦
Fasterxml
Jackson Databind
>= 2.0.0 and < 2.6.7.3📦
Fasterxml
Jackson Databind
>= 2.7.0 and < 2.8.11.5📦
Fasterxml
Jackson Databind
>= 2.9.0 and < 2.9.10.1💻
Debian
Debian Linux
= 8.0📦
Redhat
Jboss Enterprise Application Platform
= 7.2📦
Redhat
Jboss Enterprise Application Platform
= 7.3📦
Oracle
Banking Platform
= 2.4.0📦
Oracle
Banking Platform
= 2.4.1📦
Oracle
Banking Platform
= 2.5.0📦
Oracle
Banking Platform
= 2.6.0📦
Oracle
Banking Platform
= 2.6.1📦
Oracle
Banking Platform
= 2.6.2📦
Oracle
Banking Platform
= 2.7.0📦
Oracle
Banking Platform
= 2.7.1📦
Oracle
Banking Platform
= 2.9.0📦
Oracle
Communications Billing And Revenue Management
= 7.5.0.23.0📦
Oracle
Communications Billing And Revenue Management
= 12.0.0.3.0📦
Oracle
Communications Calendar Server
= 8.0.0.2.0📦
Oracle
Communications Calendar Server
= 8.0.0.3.0📦
Oracle
Communications Cloud Native Core Network Slice Selection Function
= 1.2.1📦
Oracle
Communications Evolved Communications Application Server
= 7.1📦
Oracle
Global Lifecycle Management Nextgen Oui Framework
= 12.2.1.3.0📦
Oracle
Global Lifecycle Management Nextgen Oui Framework
= 12.2.1.4.0📦
Oracle
Global Lifecycle Management Nextgen Oui Framework
= 13.9.4.2.2📦
Oracle
Goldengate Application Adapters
= 19.1.0.0.0📦
Oracle
Jd Edwards Enterpriseone Orchestrator
= 9.2📦
Oracle
Jd Edwards Enterpriseone Tools
= 9.2📦
Oracle
Primavera Gateway
>= 17.7 and <= 17.12.6📦
Oracle
Primavera Gateway
>= 18.8.0 and <= 18.8.8📦
Oracle
Primavera Gateway
= 16.1📦
Oracle
Primavera Gateway
= 16.2📦
Oracle
Primavera Gateway
= 19.12.0📦
Oracle
Retail Merchandising System
= 15.0.3📦
Oracle
Retail Merchandising System
= 16.0.2📦
Oracle
Retail Merchandising System
= 16.0.3📦
Oracle
Retail Sales Audit
= 14.1📦
Oracle
Siebel Engineering Installer \& Deployment
<= 2.20.5📦
Oracle
Trace File Analyzer
= 12.2.0.1📦
Oracle
Trace File Analyzer
= 18c📦
Oracle
Trace File Analyzer
= 19c📦
Oracle
Webcenter Portal
= 12.2.1.3.0📦
Oracle
Webcenter Portal
= 12.2.1.4.0📦
Oracle
Webcenter Sites
= 12.2.1.3.0📦
Oracle
Webcenter Sites
= 12.2.1.4.0📦
Oracle
Weblogic Server
= 12.2.1.3.0📦
Oracle
Weblogic Server
= 12.2.1.4.0📦
Netapp
Oncommand Workflow Automation
All versions📦
Netapp